User:MrLavoie/Security Content Automation Protocol
 | This is the sandbox page where you will draft your initial Wikipedia contribution.
If you're starting a new article, you can develop it here until it's ready to go live. If you're working on improvements to an existing article, copy only one section at a time of the article to this sandbox to work on, and be sure to use an edit summary linking to the article you copied from. Do not copy over the entire article. You can find additional instructions here. Remember to save your work regularly using the "Publish page" button. (It just means 'save'; it will still be in the sandbox.) You can add bold formatting to your additions to differentiate them from existing content. |
Article Draft
[edit]Lead
[edit]The Security Content Automation Protocol (SCAP) is a method for using specific standards to enable automated vulnerability management, measurement, and policy compliance evaluation of systems deployed in an organization, including e.g., FISMA (Federal Information Security Management Act, 2002) compliance. The National Vulnerability Database (NVD) is the U.S. government content repository for SCAP. An example of an implementation of SCAP is OpenSCAP.
SCAP is a suite of tools that have been compiled to be compatible with various protocols for things like configuration management, compliance requirements, software flaws, or vulnerabilities patching. Accumulation of these standards provides a means for data to be communicated between humans and machines efficiently. The objective of the framework is to promote a communal approach to the implementation of automated security mechanisms that are not monopolized.[1]
Article body
[edit]Purpose
[edit]To guard against security threats, organizations need to continuously monitor the computer systems and applications they have deployed, incorporate security upgrades to software and deploy updates to configurations. The Security Content Automation Protocol (SCAP), pronounced "ess-cap",[2] but most commonly as "skap" comprises of a number of open standards that are widely used to enumerate software flaws and configuration issues related to security. Applications which conduct security monitoring use the standards when measuring systems to find vulnerabilities and offer methods to score those findings to evaluate the possible impact. The SCAP suite of specifications standardizes the nomenclature and formats used by these automated vulnerability management, measurement, and policy compliance products.
SCAP provides several advantages for organizations that implement it as a standalone feature or as a component within their pre-existing Improves cybersecurity framework. Benefits include increased vulnerability assessment efficiency, decreased labor intensive compliance related tasks, simplification of software deployments, and promotes a communal approach to collaboration within the cybersecurity space.
SCAP Checklists
[edit]Security Content Automation Protocol (SCAP) checklists standardize and enable automation of the linkage between computer security configurations and the NIST Special Publication 800-53 (SP 800-53) controls framework. Since 2018, version 1.3 of SCAP is meant to perform initial measurement and continuous monitoring of security settings and corresponding SP 800-53 controls. Future versions will likely standardize and enable automation for implementing and changing security settings of corresponding SP 800-53 controls. In this way, SCAP contributes to the implementation, assessment, and monitoring steps of the NIST Risk Management Framework. Accordingly, SCAP forms an integral part of the NIST FISMA implementation project.
SCAP Validation Program
[edit]The SCAP Validation Program tests the ability of products to employ SCAP standards. The NIST National Voluntary Laboratory Accreditation Program (NVLAP) accredits independent laboratories under the program to perform SCAP validations. A vendor of a computer system configuration scanner can get their product validated against SCAP, demonstrating that it will interoperate with other scanners and express the scan results in a standardized way. Vendors seeking validation of a product can contact an NVLAP accredited SCAP validation laboratory for assistance in the validation process.
A customer who is subject to the FISMA requirements or wants to use security products that have been tested and validated to the SCAP standard by an independent third-party laboratory, should visit the SCAP validated products web page to verify the status of the product(s) being considered.
SCAP Components
[edit]SCAP defines how the following standards (referred to as SCAP 'Components') are combined: Starting with SCAP version 1.0 (November, 2009)
- Common Vulnerabilities and Exposures (CVE)
- Common Configuration Enumeration (CCE) (prior web-site at MITRE)
- Common Platform Enumeration (CPE)
- Common Vulnerability Scoring System (CVSS)
- Extensible Configuration Checklist Description Format (XCCDF)
- Open Vulnerability and Assessment Language (OVAL)
Starting with SCAP version 1.1 (February, 2011)
Starting with SCAP version 1.2 (September, 2011)
- Asset Identification (AID)
- Asset Reporting Format (ARF)
- Common Configuration Scoring System (CCSS)
- Trust Model for Security Automation Data (TMSAD)
Starting with SCAP version 1.3 (February, 2018)
References
[edit]- ^ Computer Security Division, Information Technology Laboratory (2016-12-07). "Security Content Automation Protocol | CSRC | CSRC". CSRC | NIST. Retrieved 2024-01-15.
- ^ Radack, Shirley; Kuhn, Rick (2011-02-04). "Managing Security: The Security Content Automation Protocol". IT Professional. 13 (1): 9–11. doi:10.1109/MITP.2011.11. ISSN 1520-9202. S2CID 5344382.