# Presentation: 175939

##             1 August 2007 Update
Matt Barrett
National Institute of Standards and Technology

-             1 August 2007 Update
- Matt Barrett
- National Institute of Standards and Technology

## Agenda

- Basis for SCAP
- SCAP Primer
- Use of SCAP during FDCC Testing
- Accomplishing FDCC with SCAP
- Relationship Between FDCC and SCAP Product Compliance
- Applicability for SCAP Beyond FDCC
- Conclusion

## Current Compliance and Configuration Management

## OMB Memo M-07-11Implementation of Commonly Accepted Security Configurations for Windows Operating Systems

- Corresponding OMB Memo to CIOs:
-   Requires, **“Implementing and automating enforcement of these configurations;”**
- “NIST has established a program to develop and maintain common security configurations for many operating systems and applications, and **the “Security Content Automation [Protocol]” can help your agency use common security configurations.** Additionally, NIST’s revisions to Special Publication 800-70, “Security Configuration Checklist Program for IT Products,” will provide your agency additional guidance for implementing common security configurations.  For additional information about NIST’s programs, please contact Stephen Quinn, at _[Stephen.Quinn@nist.gov](mailto:Stephen.Quinn@nist.gov)_.”

- OMB Memo M-07-11*Implementation of Commonly Accepted Security Configurations for Windows Operating Systems*

## Security Content Automation ProtocolStandardizing How We Communicate

|  | CVE | Common Vulnerability Enumeration | Standard nomenclature and dictionary of security related software flaws |
| --- | --- | --- | --- |
|  | CCE | Common Configuration Enumeration | Standard nomenclature and dictionary of software misconfigurations |
|  | CPE | Common Platform Enumeration | Standard nomenclature and dictionary for product naming |
|  | XCCDF | eXtensible Checklist Configuration Description Format
 | Standard XML for specifying checklists and for reporting results of checklist evaluation |
|  | OVAL | Open Vulnerability Assessment Language | Standard XML for test procedures |
|  | CVSS | Common Vulnerability Scoring System | Standard for measuring the impact of vulnerabilities |

- Cisco, Qualys, Symantec, Carnegie Mellon University

- Security Content Automation Protocol*Standardizing How We Communicate*

## Integrating IT and IT Security Through SCAP

- Management

- Vulnerability Management

- Configuration
- Management

- CVE

- CPE

- CCE

**SCAP**

- OVAL
- CVSS

- Compliance Management

- XCCDF

- Misconfiguration

## 50 million hits per year
20 new vulnerabilities per day
Mis-configuration cross references to:
NIST SP 800-53 Security Controls (All 17 Families and 163 controls)
DoD IA Controls
DISA VMS Vulnerability IDs
Gold Disk VIDs
DISA VMS PDI IDs
NSA References
DCID
ISO 17799
Reconciles software flaws from:
US CERT Technical Alerts
US CERT Vulnerability Alerts (CERTCC)
MITRE OVAL Software Flaw Checks
MITRE CVE Dictionary
Produces XML feed for NVD content

- 20 new vulnerabilities per day
- Mis-configuration cross references to:
- NIST SP 800-53 Security Controls (All 17 Families and 163 controls)
- DoD IA Controls
- DISA VMS Vulnerability IDs
- Gold Disk VIDs
- DISA VMS PDI IDs
- NSA References
- DCID
- ISO 17799
- Reconciles software flaws from:
- US CERT Technical Alerts
- US CERT Vulnerability Alerts (CERTCC)
- MITRE OVAL Software Flaw Checks
- MITRE CVE Dictionary
- Produces XML feed for NVD content

- In response to NIST being named in the Cyber Security R&D Act of 2002
- Encourages vendor development and maintenance of security guidance
- Currently hosts 112 separate guidance documents for over 125 IT products
- Participating organizations: DISA, NSA, NIST, Hewlett-Packard, CIS, ITAA, Oracle, Sun, Apple, Microsoft, Citadel, LJK, Secure Elements, ThreatGuard, MITRE Corporation, G2, Verisign, Verizon Federal, Kyocera, Hewlett-Packard, ConfigureSoft, McAfee, etc.
- Translating this backlog of checklists into the Security Content Automating Protocol (SCAP)

- Existing Federal Services*Standardizing What We Communicate*

## How SCAP Works

- Platform	      	  CPE
-   Misconfiguration   CCE
-  Software Flaw	  CVE

- Specific Impact  CVSS
- Results
- Specific Impact  CVSS
- Results

_**Test Procedures**_**   OVAL**

_**Patches**_**   ****	****  OVAL**

## FDCC Testing

- Implement FDCC settings on virtual machine images
- Use SCAP to verify FDCC settings were implemented correctly
- Windows XP
- Windows Vista
- Windows XP Firewall
- Windows Vista Firewall
- Internet Explorer 7.0
- Reconcile any “failed” SCAP tests
- Record any exceptions

## Accomplishing FDCC with SCAP

| Operations Teams | Product Teams | Function |
| --- | --- | --- |
|  |  | Test to ensure products do not change the FDCC settings |
|  |  | Assess new implementations for FDCC compliance |
|  |  | Monitor previous implementations for FDCC compliance |
|  |  | Generate FDCC compliance and deviation reports |

- Quote from OMB Memo *Establishment of Windows XP and VISTA Virtual Machine and Procedures for Adopting the Federal Desktop Core Configurations*
- “**Information technology providers** must use S-CAP validated tools, as they become available, to **certify their products** do not alter these configurations, and **agencies** must use these tools **when monitoring** use of these configurations. “

## OMB Memo M-07-18Ensuring New Acquisitions Include Common Security Configurations

- “**The provider of information technology shall certify applications are fully functional and operate correctly as intended on systems using the Federal Desktop Core Configuration (FDCC).** This includes Internet Explorer 7 configured to operate on Windows XP and Vista (in Protected Mode on Vista).“
- “Applications designed for normal end users shall run in the standard user context **without elevated system administration privileges.**”
- “The National Institute of Standards and Technology (NIST) and the Department of Homeland Security continue to work with Microsoft to **establish a virtual machine** to provide agencies and information technology providers’ access to Windows XP and VISTA  images. The images will be **pre-configured with the recommended security settings for test and evaluation purposes to help certify applications operate correctly.**** **“

- OMB Memo M-07-18*Ensuring New Acquisitions Include Common Security Configurations*

## OMB 31 July 2007 Memo to CIOsEstablishment of Windows XP and VISTA Virtual Machine and Procedures for Adopting the Federal Desktop Core Configurations

- “As we noted in the June 1, 2007 follow-up policy memorandum M-07-18, “Ensuring New Acquisitions Include Common Security Configurations,” **a virtual machine would be established “to provide agencies and information technology providers’ access to Windows XP and VISTA images.”**  The National Institute of Standards and Technology (NIST), Microsoft, the Department of Defense, and the Department of Homeland Security have now established a website hosting the virtual machine images, which can be found at: _http://csrc.nist.gov/fdcc_.”
- “Your agency can now acquire information technology products that are self-asserted by information technology providers as compliant with the Windows XP & VISTA FDCC, and **use NIST’s Security Content Automation Protocol (S-CAP) to help evaluate providers’ self-assertions.  Information technology providers must use S-CAP validated tools, as they become available, to certify their products do not alter these configurations, and agencies must use these tools when monitoring use of these configurations.”**

## The Relationship Between FDCC and SCAP Product Compliance

- Stakeholders

- Value

## Federal Risk Management Framework

- Continuously track changes to the information system that may affect security controls and reassess control effectiveness

-  **SP 800-37 / SP 800-53A**

**Monitor**
**Security Controls**

## <Group id="IA-5" hidden="true">
  <title>Authenticator Management</title>
    <reference>ISO/IEC 17799: 11.5.2, 11.5.3</reference>
   <reference>GAO FISCAM: AC-3.2</reference>
    <reference>DOD 8500.2: IAKM-1, IATS-1</reference>
    <reference>DCID 6/3: 4.B.2.a(7), 4.B.3.a(11)</reference>
</Group>

<Rule id="minimum-password-length" selected="false" weight="10.0">
    <reference>CCE-100</reference>
    <reference>DISA STIG Section 5.4.1.3</reference>
    <reference>DISA Gold Disk ID 7082</reference>
    <reference>PDI IAIA-12B</reference>
    <reference>800-68 Section 6.1 - Table A-1.4</reference>
    <reference>NSA Chapter 4 - Table 1 Row 4</reference>
    <requires idref="IA-5"/>
    [pointer to OVAL test procedure]
</Rule>

-   <title>Authenticator Management</title>
-     <reference>**ISO/IEC 17799: 11.5.2, 11.5.3**</reference>
-    <reference>**GAO FISCAM: AC-3.2**</reference>
-     <reference>**DOD 8500.2: IAKM-1, IATS-1**</reference>
-     <reference>**DCID 6/3: 4.B.2.a(7), 4.B.3.a(11)**</reference>
- </Group>
- <Rule id="minimum-password-length" selected="false" weight="10.0">
-     <reference>**CCE-100**</reference>
-     <reference>**DISA STIG Section 5.4.1.3**</reference>
-     <reference>**DISA Gold Disk ID 7082**</reference>
-     <reference>**PDI IAIA-12B**</reference>
-     <reference>**800-68 Section 6.1 - Table A-1.4**</reference>
-     <reference>**NSA Chapter 4 - Table 1 Row 4**</reference>
-     <requires idref="**IA-5**"/>
-     [pointer to OVAL test procedure]
- </Rule>

- Compliance Traceability within SCAP

## SCAP Value

| Feature | Benefit |
| --- | --- |
| Standardizes how computers communicate vulnerability information – the protocol | Enables interoperability for products and services of various manufacture |
| Standardizes what vulnerability information computers communicate – the content | Enables repeatability across products and services of various manufacture
Reduces content-based variance in operational decisions and actions |
| Based on open standards | Harnesses the collective brain power of the masses for creation and evolution
Created and evolved with the broadest perspective |
| Utilizes configuration and asset management standards | Mobilizes asset inventory and configuration information for use in vulnerability and compliance management |
| Applicable to Federal Risk Management Framework – Assess, Monitor, Implement | Reduces time, effort, and expense of risk management process |
| Traceable to security mandates and guidelines | Automates portions of compliance demonstration and reporting |
| Keyed on NIST SP 800-53 security controls | Automates portions of FISMA compliance demonstration and reporting |

## Stakeholders and Contributors

| DHS | Providing funding
NVD partner, Supplying threat and patch info |
| --- | --- |
| NSA | Providing resources
Applying the technology |
| DISA | Providing resources, Integrating into Host Based System Security (HBSS) and Enterprise Security Solutions |
| OSD | Incorporating into Computer Network Defense (CND) Data Strategy |
| DOJ | Incorporating into FISMA Cyber Security Assessment and Management (CSAM) tool |
| Army | Integrating Asset & Vulnerability Tracking Resource (AVTR) with DoD and SCAP content, Contributing patch dictionary |
| DOS | Incorporating into security posture by mapping SCAP to certification and accreditation process |

## 3rd Annual Security Automation Conference and Expo
19-20 September
Speakers
The Honorable Karen S. Evans (OMB)
Robert F. Lentz DAS DIIA (OSD)
Cita Furlani, Director ITL (NIST)
Tim Grance, Program Manager (NIST)
Dennis Heretick, CISO (DoJ)
Richard Hale, CIAO (DISA)
Sherrill Nicely, Deputy Associate Director (DNI)
Alan Paller, Director of Research (SANS)
Tony Sager, Chief (NSA)
Ron Ross, Program Manager (NIST)
Expo
Technology Demonstrations
Beta Testing and Use Case Presentation

- 19-20 September
- Speakers
- The Honorable Karen S. Evans (OMB)
- Robert F. Lentz DAS DIIA (OSD)
- Cita Furlani, Director ITL (NIST)
- Tim Grance, Program Manager (NIST)
- Dennis Heretick, CISO (DoJ)
- Richard Hale, CIAO (DISA)
- Sherrill Nicely, Deputy Associate Director (DNI)
- Alan Paller, Director of Research (SANS)
- Tony Sager, Chief (NSA)
- Ron Ross, Program Manager (NIST)
- Expo
- Technology Demonstrations
- Beta Testing and Use Case Presentation

- Upcoming Events

## More Information

| National Checklist Program | http://checklists.nist.gov |
| --- | --- |
| National Vulnerability Database | http://nvd.nist.gov |
| SCAP Checklists
SCAP Capable Products |  |
| NIST FDCC Web Site
FDCC Settings
Virtual Machine Images
FDCC SCAP Checklists
Group Policy Objects | http://csrc.nist.gov/fdcc |

## 100 Bureau Drive  Mailstop 8930
  Gaithersburg, MD USA 20899-8930
		ISAP NIST Project Lead		NVD Project Lead
		Steve Quinn			Peter Mell
		(301) 975-6967			(301) 975-5572			stephen.quinn@nist.gov 		mell@nist.gov
		Senior Information Security Researchers and Technical Support
		Karen Scarfone		 	Murugiah Souppaya 	
		(301) 975-8136		 	(301) 975-4758 	
		karen.scarfone@nist.gov		murugiah.souppaya@nist.gov	
		Matt Barrett			Information and Feedback
		(301) 975-3390			Web: http://nvd.nist.gov/scap
		matthew.barrett@nist.gov 		Comments: scap-update@nist.gov

**  ****Gaithersburg, MD USA 20899-8930**
***	******	******ISAP NIST Project Lead******	*****	*****NVD Project Lead***
*	**	***Steve Quinn****	****	****	****Peter Mell**
**	****	****(301) 975-6967****	****	****	****(****301) 975-****5572****	****	****	****stephen.quinn@nist.gov ****	****	****mell@nist.gov**
***	******	******Senior Information Security Researchers and Technical Support***
**	****	****Karen Scarfone****	****	**** ****	****Murugiah Souppaya ****	**
**	****	****(301) 975-8136****	****	**** ****	****(301) 975-4758 ****	**
**	****	****karen.scarfone@nist.gov****	****	****murugiah.souppaya@nist.gov****	**
**	****	****Matt Barrett****	****	****	****Information and Feedback**
**	****	****(301) 975-3390****	****	****	****Web:**** http://nvd.nist.gov/scap**
**	****	****matthew.barrett@nist.gov ****	****	****Comments:**** ****scap-update@nist.gov**

- Contact Information

## Questions

- National Institute of Standards & Technology
- Information Technology Laboratory
- Computer Security Division

## Supplemental – Connecting Compliance with Platform Assessment

## Application to Automated ComplianceThe Connected Path

- Result

- 800-53 Security Control

- 800-68 Security Guidance

- ISAP Produced Security Guidance in XML Format

- COTS Tool Ingest

- API Call

## Application to Automated ComplianceThe Connected Path

**AC-7 Unsuccessful Login Attempts**

**AC-7: Account Lockout Duration**
**AC-7: Account Lockout Threshold**

**- <registry_test id="wrt-9999" comment=“Account Lockout Duration Set to 5" check="at least 5">**
**- <object>**
**   ****<hive>HKEY_LOCAL_MACHINE</hive> **
**   ****<key>Software\Microsoft\Windows</key> **
**  ****<name>AccountLockoutDuration</name> **
**  ****</object>**
**- <data operation="AND">**
**  ****<value operator=“greater than">5*</value>**

**lpHKey = “HKEY_LOCAL_MACHINE”**
**Path = “Software\Microsoft\Windows\”**
**Value = “5”**
**sKey = “AccountLockoutDuration”**
**Op = “>“**

- 800-53 Security Control
- DoD IA Control

- 800-68 Security Guidance
- DISA STIG/Checklist
- NSA Guide

- ISAP Produced Security Guidance in XML Format

- COTS Tool Ingest

- API Call

**RegQueryValue (lpHKey, path, value, sKey, Value, Op);**
**If (Op == ‘>” )**
**if ((sKey < Value ) **
**return (1); else **
**return (0);**

- Application to Automated Compliance*The Connected Path*

## Supplemental – SCAP Platform Assessment Tutorial

## XML Made Simple

**XCCDF - eXtensible Car Care Description Format**

**OVAL – Open Vehicle Assessment Language**

**<Car>**
**  ****<Description> **
**    ****<Year> 1997 </Year>**
**    ****<Make> Ford </Make>**
**    ****<Model> Contour </Model>**
**  ****<Maintenance>**
**    ****<Check1> Gas Cap = On <>**
**    ****<Check2>Oil Level = Full <>**
-   **</Maintenance>**
** ****</Description>**
**</Car>**

**<Checks>**
**  ****<Check1>**
**     ****<Location> Side of Car <>       **
**     ****<Procedure> Turn <>**
**  ****</Check1>**
**  ****<Check2>**
**     ****<Location> Hood <>**
**     ****</Procedure> ... <>**
**  ****</Check2>**
**</Checks>**

## XML Made Simple

**XCCDF - eXtensible Checklist Configuration Description Format**

**OVAL – Open Vulnerability Assessment Language**

**<Document ID> NIST SP 800-68 **
**  ****<Date> 04/22/06 </Date>**
**    ****<Version> 1 </Version>**
**    ****<Revision> 2 </Revision>**
** ****<Platform> ****Windows XP**** <>**
**    ****<Check1> ****Password >= 8**** <>**
**    ****<Check2> ****Win XP Vuln**** <>**
-   **</Maintenance>**
** ****</Description>**
**</Car>**

**<Checks>**
**  ****<Check1>**
**     ****<Registry Check> ... <>       **
**     ****<Value> 8 </Value>**
**  ****</Check1>**
**  ****<Check2>**
**     ****<File Version> ... <>**
**     ****<Value> 1.0.12.4 </Value>**
**  ****</Check2>**
**</Checks>**

|  | CPE |
| --- | --- |
|  | CCE |
|  | CVE |

## Supplemental – FAQ for NIST FISMA Documents

## Fundamental FISMA Questions

**What are the NIST Technical Security Controls?**

**What are the **_***Specific***_** NIST recommended settings for individual technical controls?**

**Am I compliant to NIST Recs & Can I use my COTS Product?**

**How do I implement the recommended setting for technical controls? Can I use my COTS Product?**

**Will I be audited against the same criteria I used to secure my systems?**

## Fundamental FISMA Documents

**What are the NIST Technical Security Controls?**

**What are the **_***Specific***_** NIST recommended settings for individual technical controls?**

**Am I compliant to NIST Recs & Can I use my COTS Product?**

**How do I implement the recommended setting for technical controls? Can I use my COTS Product?**

**Will I be audited against the same criteria I used to secure my systems?**

** ****SP 800-53A / SP 800-26 **
**/ SP 800-37**

**Security Control Assessment**

** ****SP 800-53 / FIPS 200**
** ****/ SP 800-30**

**Security Control Refinement**