**Information Security Automation Program**

Automating Vulnerability Management, Security Measurement, and
Compliance

Version 1.0 Beta, Last Revised 5/22/2007

**What is the Information Security Automation Program?**

This capability is achieved through the Information Security Automation
Program (ISAP). ISAP, pronounced "I Sap", is a U.S. government
multi-agency initiative to enable automation and standardization of
technical security operations. While a U.S. government initiative, its
standards based design can benefit all information technology security
operations. The ISAP high level goals include standards based automation
of security checking and remediation as well as automation of technical
compliance activities (e.g. FISMA). ISAP's low level objectives include
enabling standards based communication of vulnerability data,
customizing and managing configuration baselines for various IT
products, assessing information systems and reporting compliance status,
using standard metrics to weight and aggregate potential vulnerability
impact, and remediating identified vulnerabilities.

ISAP's technical specifications are contained in the related Security
Content Automation Protocol (SCAP), see below and at
<http://nvd.nist.gov/scap.cfm>. Also on this web page are vendor
compatibility requirements. ISAP's security automation content is either
contained within, or referenced by, the National Vulnerability Database
([http://nvd.nist.gov](http://nvd.nist.gov/)).

ISAP is being formalized through a trilateral memorandum of agreement
(MOA) between Defense Information Systems Agency (DISA), the National
Security Agency (NSA), and the National Institute of Standards and
Technology (NIST). The Office of Secretary of Defense (OSD) also
participates and the Department of Homeland Security (DHS) funds the
operation infrastructure on which ISAP relies (i.e., the National
Vulnerability Database).

**How does NIST recommend that organizations use ISAP/SCAP to achieve
the greatest benefit?**

There are a variety of ways in which agencies and other organizations
can use NVD and ISAP to their benefit. To achieve these benefits,
organizations will generally need to acquire SCAP compatible tools (see
<http://nvd.nist.gov/tools.cfm> for a preliminary list of participating
vendors). Additional benefits can be obtained by aligning internal
security operations with SCAP vulnerability, product, and scoring
enumerations and mappings. Here is a list of benefits:

[Secure Configurations]{.underline}

Agencies and other organizations should consistently monitor their
operating systems and applications, using SCAP tools and content, to
ensure that they maintain a secure configuration. Such tools can also
assist with automating implementing an initial secure configuration for
new assets (secure images may also be used for this purpose in some
cases). Within the U.S. government, SCAP should be used to ensure that
operating systems and applications conform to NIST security
configuration guidance. The DOD also publishes SCAP content and DOD
profiles are often available within NIST SCAP content.

[FISMA Technical Control Compliance Automation]{.underline}

Agencies and other organizations can automate much of their FISMA
technical security control compliance activities by regularly scanning
information technology assets using SCAP checklists. SCAP checklists
have FISMA compliance mappings embedded within the checklist so that
SCAP-compatible tools can automatically generate NIST Special
Publication 800-53 assessment and compliance evidence. Each low level
security configuration check is mapped to the appropriate high level
NIST SP 800-53 security controls. As draft NIST SP 800-53A progresses
towards final publication, there will be a direct linkage, where
appropriate, of the assessment procedures found in NIST SP 800-53A to
the SCAP automated testing of information system mechanisms and
associated security configuration settings. In addition, the SCAP
checklists also contain mappings to other high level policies (e.g.,
ISO, DOD 8500, FISCAM) and SCAP tools may also output those compliance
mappings.

[Customization of Recommended Secure Configurations]{.underline}

Agencies and other organizations should customize recommended SCAP
secure configurations (e.g., NIST checklists) to tailor them to specific
environments. SCAP checklists, being represented in standards based XML
formats, are an ideal format for customization. Organizations can modify
checks, delete checks, add new checks, and digitally sign their changes.
Then SCAP compatible tools will be able to automatically process the
customized checklists (without any additional coding being required or
even any involvement from the SCAP tool vendor).

[Security Measurement]{.underline}

Agencies and other organizations should measure the security, relative
to known security related software flaws and misconfigurations, of all
operating units using standard impact scores that can be customized to
each particular environment. Agencies and other organizations should be
able to aggregate these measurements to understand the relative security
of the organization over time. Adoption of SCAP enables this by
providing a vulnerability measurement system, standard impact scores for
virtually all vulnerabilities, and a methodology by which to customize
those scores to particular environments (e.g., by FIPS 199 and DOD
MAC/CONF levels).

[Integration and Automation of Security Operations]{.underline}

Agencies and other organizations should integrate and automate disjoint
security operations activities and databases through adoption of SCAP.
This can be achieved by integrating vulnerability databases, incident
databases, intrusion detection databases, and asset databases using SCAP
data as primary keying material. For example, all security products and
databases should use standard names for software flaws, configuration
issues, and product names.

[Communications Involving Vulnerabilities]{.underline}

Agencies and other organizations should use SCAP vulnerability and
product naming enumeration standards when communicating about
vulnerabilities (security related software flaws and misconfigurations).
Agencies and other organizations should report incident details (both
internally and externally) using SCAP vulnerability and product names to
the greatest extent possible. This ensures that all vulnerability
communications precisely identify the relevant low level issues, enable
integration of data feeds using this same standardized language, and
enable easy correlation with other data repositories that may have
additional information on the relevant vulnerabilities.

**How does SCAP help with FISMA compliance? With complying to other
mandates?**

Security Content Automation Protocol (SCAP) checklists standardize and
enable automation of the linkage between computer security
configurations and the NIST Special Publication 800-53 Revision 1 (SP
800-53 Rev1) controls framework. The current version of SCAP is meant to
perform initial measurement and continuous monitoring of security
settings and corresponding SP 800-53 Rev1 controls. Future versions will
likely standardize and enable automation for implementing and changing
security settings of corresponding SP 800-53 Rev1 controls. In this way,
SCAP contributes to the implementation, assessment, and monitoring steps
of the NIST Risk Management Framework. Accordingly, SCAP is an integral
part of the NIST FISMA implementation project.

Since SCAP allows for mapping and traceability of multiple legislation
and directives (aka mandates) to a single security configuration, it
enables compliance management beyond FISMA, including but not limited to
key Department of Defense, Intelligence Community, and even commercial
(e.g., HIPAA, Sarbanes-Oxley) mandates. This is achieved by mapping
platform evaluation checks and test procedures to corresponding SP
800-53 Rev1 security controls, which in turn are mapped to specific
sections of legislation and directives.

Since the linkage between computer security configuration and the
mandates from whence they originated is hard coded into machine readable
SCAP checklists, all mapping and traceability is 100% transparent. At
the same time, because these mappings originate from NIST, DISA, and
NSA, those mappings are authoritative for all U.S. Government agencies.
This represents a change in the way vulnerability and compliance
management tools have historically operated. In the past, organizations
like NIST, DISA, and NSA have authored or facilitated authorship of
human readable or non-standardized machine readable checklists, and COTS
or GOTS maintainers then needed to translate those authoritative
guidelines into a machine readable checklist that COTS or GOTS tools
could understand. In the process, authoritative checklists were subject
to interpretation, rendering the checklists non-authoritative once the
translation process was complete. By using standardized SCAP content,
COTS and GOTS maintainers avoid invalidating checklists through
translation, and more importantly, security operations personnel are now
using authoritative checklists to validate their vulnerability and
compliance status relative to government guidelines, standards, and
mandates.

**Who authors SCAP checklists and test procedures?**

SCAP checklists and test procedures are authored, tested, and approved
according to the National Checklist Program
(<http://nvd.nist.gov/ncp.cfm>). More specifically, SCAP checklists and
test procedures can be authored by almost any entity, including vendors
of the actual products. SCAP checklists and test procedures are then
processed through the eight step NIST Special Publication 800-70 IT
Product Checklist Lifecycle. Subsequently, SCAP checklists and test
procedures becomes officially acknowledged and published. All SCAP
checklists are either published within or referenced by the National
Vulnerability Database (NVD,
[http://nvd.nist.gov](http://nvd.nist.gov/)) Web site. SCAP checklists
conform to the SCAP XCCDF style guide and template.

**Who approves SCAP checklists and test procedures?**

As a final step before new SCAP checklists and test procedures are
considered SCAP content, the ISAP assures new SCAP checklists and test
procedures are cross referenced correctly against 800-53 Rev1 security
controls and that they follow the SCAP template. Also, ISAP ensures that
the official mapping from those 800-53 Rev 1 security controls to
corresponding NIST, DISA, and NSA mandates, standards, and guidelines is
present in the XCCDF. These steps assure traceability of SCAP checks to
the guidelines, standards, and mandates they validate. Once these steps
occur, ISAP digitally signs the SCAP checklist and test procedures to
provide a means to validate the integrity of the content.

**Who approves deviations from ISAP approved SCAP checklists and test
procedures?**

Non-U.S. government organizations may tailor SCAP checklists at their
discretion. Federal agencies may also elect to deviate from ISAP
approved SCAP checklists and test procedures. For Federal agencies, NIST
recommends that agencies annotate deviations, create agency specific
versions of SCAP content, and digitally sign the resulting checklists.
The agency digital signature will allow various units of the agency to
verify the risk associated with the deviation has been accepted at the
agency level. SCAP technology allows this risk acceptance process to be
extended to whatever level of agency unit is appropriate.

**Where can I obtain SCAP checklists and test procedures?**

The National Vulnerability Database (NVD,
[http://nvd.nist.gov](http://nvd.nist.gov/)) is the U.S. government
repository for SCAP content. More specifically, NVD will publish all
vulnerabilities using SCAP standards, such that users can select a
platform or grouping of platforms and have some or all vulnerabilities
associated with that/those platforms either displayed in human-readable
format via the Web page or downloaded in the form of SCAP content.

**I currently utilize the NIST National Checklist Program as a source of
security configuration settings for my computers. How does the existence
of SCAP change the National Checklist Program?**

SCAP does not change the function of the National Checklist Program. As
mentioned above, the National Checklist Program uses the eight step IT
Product Checklist Lifecycle from NIST Special Publication 800-70 to
ordain checklists. This same lifecycle will be used for SCAP checklists.
The National Checklist Program is now a part of the National
Vulnerability Database (NVD) since NVD is the official repository for
SCAP content.

**Are there any fees or licensing restrictions associated with SCAP
checklists and Test Procedures?**

There are no licensing fees of restrictions associated with the SCAP
content hosted through the National Vulnerability Database (NVD,
[http://nvd.nist.gov](http://nvd.nist.gov/)). Vendors, government
agencies, and other organizations are encouraged to use this SCAP
content for whatever purposes they envision, including as a source for
SCAP capable tools. Note that SCAP enumeration data is derived from open
standards.

**Which vendors provide COTS that utilize SCAP checklists and test
procedures?**

The current list of SCAP capable vendors is available at
<http://nvd.nist.gov/tools.cfm>.

**Have all vendors which advertise "SCAP-compliant" for their product
implemented the SCAP standard in an identical manner?**

Buyers are encouraged to research "SCAP compatible" products and
services thoroughly before investing. Note that not all products have
fully implemented every SCAP standard. See the SCAP website on NVD for
information on SCAP compatible products and for lists of products.

ISAP is starting up a compliance program around SCAP to promote
comprehensive usage of the SCAP standards. The true power of SCAP is in
bringing together IT and IT security domains, which requires
implementation of all SCAP standards. To encourage evolution toward this
vision, ISAP will ordain a designator for products which communicate
using all SCAP standards and utilize NVD reference data as the basis for
platform evaluation. To earn this designator, products must first be
tested to verify full SCAP capability. ISAP is currently in the process
of designing a program to accredit SCAP test laboratories. As
laboratories are being accredited, ISAP will officially ordain the
current version of SCAP and announce a designator to be associated with
products and services which are compliant with all SCAP standards.

**Will ISAP expand SCAP to include additional standards?**

ISAP recognizes a fuller vision for IT and IT security than the
near-term suite of SCAP standards will accommodate. For this reason,
ISAP intends to evolve the SCAP standards list over time. Examples of
future additions to the SCAP standards list include Common Remediation
Enumeration (CRE) and Open Vulnerability Remediation Language (OVRL) to
address security control implementation and vulnerability remediation
activities.

**Can SCAP be applied for IT functions other than security?**

Absolutely. While SCAP was designed with a security focus, similar
combinations of standards are applicable in domains outside of security.
For example, formulating checklists by embedding CCE and CPE in XCCDF,
and pairing these checklists with corresponding test procedures can
enable a wide variety of configuration management platform evaluations;
not just for misconfiguration, but for configuration at large. Adoption
of SCAP standards for non security purposes is encouraged, as the
benefits of standardization and automation are universal.

**If I use SCAP for standardizing and automating my organization's
vulnerability and compliance management practices, am I required to use
SCAP standards for related IT disciplines like asset and configuration
management?**

Implementing SCAP standards in peripheral disciplines like asset and
configuration management is not mandatory when using SCAP to standardize
and automate security operations. However, implementing the enumeration
standards Common Configuration Enumeration (CCE) within configuration
management practices and Common Platform Enumeration (CPE) within asset
management practices will partially standardize those practices, set the
stage for automation, including automation across products of various
manufacture, and enable interoperability at the interfaces between your
configuration, asset, vulnerability, and compliance management
practices. The net affect is more efficiency throughout IT programs and
forwarding the vision of "baking security in" to IT. As a first step
toward obtaining these benefits, ISAP recommends you initiate dialog
with your configuration and asset management vendors with regards to
their plan for implementing applicable SCAP standards and automating
interfaces with products and services that exist in the vulnerability
and compliance management domains.