# Presentation: 667856

## NSA/DISA/NISTSecurity Content Automation ProgramVulnerability Compliance & Measurement

*Stephen Quinn & Peter Mell*
*Computer Security Division*
***NIST***

## Introductory Benefits

- COTS Tool Vendors –
- Provision of an enhanced IT security data repository
- No cost and license free
- CVE/OVAL/XCCDF/CVSS/CCE
- Cover both patches and configuration issues
- Elimination of duplication of effort
- Cost reduction through standardization
- Federal Agencies
- Automation of technical control compliance (FISMA)
- Ability of agencies to specify how systems are to be secured

## Current ProblemsConceptual Analogy

- Current Problems*Conceptual Analogy*

## Current ProblemsConceptual Analogy Continued (2)

- Current Problems*Conceptual Analogy Continued (2)*

**Outsource**

**In-House**

## Current ProblemsConceptual Analogy Continued (3)

**Outsource**

**In-House**

**a.) Troubleshoot/Analyze**

-  Conduct Testing
-  Is there a problem?
-  Cause of error condition?
-  Is this check reporting correctly?

**b.) Document/Report Findings**

**c.) Recommendations**

**d.) Remediate**

- Current Problems*Conceptual Analogy Continued (3)*

## Current ProblemsConceptual Analogy Continued (5)

**a.) Troubleshoot/Analyze**

-  Conduct Testing
-  Is there a problem?
-  Cause of error condition?
-  Is this check reporting correctly?

**b.) Document/Report Findings**

**c.) Recommendations**

**d.) Remediate**

**Standardize & Automate**

**a.) Troubleshoot/Analyze**

-  Is there a problem?
-  Cause of error condition?
-  Is this check reporting correctly?

- More DATA

- Current Problems*Conceptual Analogy Continued (5)*

## Current ProblemsConceptual Analogy Continued (6)

- Current Problems*Conceptual Analogy Continued (6)*

**Before**

**After**

***Error Report***

_**Problem**_**:**
** ***Air Pressure Loss*

_**Diagnosis Accuracy**_**:**
*All Sensors Reporting*

_**Expected Cost**_**:**
** ***$25.00*

_**Diagnosis**_**:**
*Replace Gas Cap*

## Compliance & Security

- Problem – Comply with policy.
- How – Follow recommended guidelines – So many to choose from.
- Customize to your environment – So many to address.
- Document your exceptions – I’ve mixed and matched, now what?
- Ensure someone reads your exceptions – Standardized reporting format.
- Should be basic:
- One coin, different sides.
- If I configure my system to compliance regulation does is mean its secure and vice versa?

## The Current Quagmire...

- Agency must secure system.
- Agency much comply with regulations.
- Agency must use certain guidelines.
- Agency must ensure IT system functionality.
- Agency must report compliance after customization and ensuring functionality.
- Agency must report.
- Agency must be heard and understood.

## ...Looks Like This...

**Agency Baseline **
**Configuration**

**DISA STIG (Gold)**

**Reporting Compliance**

**DISA STIG (Platinum)**

**NIST Special Pub.**

**NSA Guide**

**Vendor Guide**

**Mobile User**

**Enterprise**

- ...Looks Like This...

- Finite Set of Possible Known Security Configuration Options & Patches

**Other**

- 1 to n

- Environment

**Tool Vendor Rec.**

## ...Looks Like This.

- ...Looks Like This.

**Reporting Compliance**

- Now Report Compliance

## A Closer Look At Operations

**Agency Baseline **
**Configuration**

**Reporting Compliance**

**DISA Platinum**

**NIST Special Pub**

**DISA Gold**

**NSA Guide**

**Vendor Guide**

- Finite Set of Possible Known Security Configuration Options and Patches

**Mobile User**

**Enterprise**

**Other**

- What If IT System Deployed Elsewhere?

- New CIO: Why Not Use the Vendor's Guide?

## A Closer Look At Operations

**Agency Baseline **
**Configuration**

**DISA Platinum**

**NIST Special Pub**

**DISA Gold**

**NSA Guide**

**Vendor Guide**

- Finite Set of Possible Known Security Configuration Options and Patches

**Mobile User**

**Enterprise**

**Other**

- What Happens When Changes Occur to the Vendor Guide?

## How Security Automation Helps

**Agency Baseline **
**Configuration**

**DISA Platinum**

**NIST Special Pub**

**DISA Gold**

**NSA Guide**

**Vendor Guide**

- Finite Set of Possible Known Security Configuration Options and Patches

**Mobile User**

**Enterprise**

**Other**

- All of the “How To” and “Mapping” Performed Here!

**Security Automation Content Program (SCAP)**

## How Does This Work?

**Agency Baseline **
**Configuration**

**DISA Platinum**

**NIST Special Pub**

**DISA Gold**

**NSA Guide**

**Vendor Guide**

- OVAL
- CVE + CCE

**Mobile User**

**Enterprise**

**Other**

**XCCDF**

**XCCDF**

## Legacy Baselines?

**Agency Baseline **
**Configuration**

**DISA Platinum**

**NIST Special Pub**

**DISA Gold**

**NSA Guide**

**Vendor Guide**

- OVAL
- CVE + CCE

**XCCDF**

**XCCDF**

**XCCDF**

**Mobile User**

**Enterprise**

**Other**

## XML Made Simple

**XCCDF - eXtensible Car Care Description Format**

**OVAL – Open Vehicle Assessment Language**

**<Car>**
**  ****<Description> **
**    ****<Year> 1997 </Year>**
**    ****<Make> Ford </Make>**
**    ****<Model> Contour </Model>**
**  ****<Maintenance>**
**    ****<Check1> Gas Cap = On <>**
**    ****<Check2>Oil Level = Full <>**
-   **</Maintenance>**
** ****</Description>**
**</Car>**

**<Checks>**
**  ****<Check1>**
**     ****<Location> Side of Car <>       **
**     ****<Procedure> Turn <>**
**  ****</Check1>**
**  ****<Check2>**
**     ****<Location> Hood <>**
**     ****</Procedure> ... <>**
**  ****</Check2>**
**</Checks>**

## XCCDF & OVAL Made Simple

**XCCDF - eXtensible Checklist Configuration Description Format**

**OVAL – Open Vulnerability Assessment Language**

**<Document ID> NIST SP 800-68 **
**  ****<Date> 04/22/06 </Date>**
**    ****<Version> 1 </Version>**
**    ****<Revision> 2 </Revision>**
** ****<Platform> Windows XP**
**    ****<Check1> Password >= 8 <>**
**    ****<Check2> FIPS Compliant <>**
-   **</Maintenance>**
** ****</Description>**
**</Car>**

**<Checks>**
**  ****<Check1>**
**     ****<Registry Check> ... <>       **
**     ****<Value> 8 </Value>**
**  ****</Check1>**
**  ****<Check2>**
**     ****<File Version> ... <>**
**     ****<Value> 1.0.12.4 </Value>**
**  ****</Check2>**
**</Checks>**

## Automated ComplianceThe Connected Path

- 800-53 Security Control
- DISA STIG

- 800-68 Security Guidance
- DISA Checklist
- NSA Guide

- SCAP Produced Security Guidance in XML Format

- COTS Tool Ingest

- API Call

- Result

## Automated Compliance

**RegQueryValue (lpHKey, path, value, sKey, Value, Op);**
**If (Op == ‘>” )**
**if ((sKey < Value ) **
**return (1); else **
**return (0);**

- Result

**AC-7 Unsuccessful Login Attempts**

**AC-7: Account Lockout Duration**
**AC-7: Account Lockout Threshold**

- _[-](http://images.google.com/imgres?imgurl=http://www.nsa.gov/selinux/list-archive/att-6750/selinux.jpg&imgrefurl=http://www.nsa.gov/selinux/list-archive/0404/6750.cfm&h=255&w=254&sz=26&tbnid=HfBT_Kk9BC3gHM:&tbnh=106&tbnw=105&hl=en&start=12&prev=/images%3Fq%3Dnsa%2Blogo%26svnum%3D10%26hl%3Den%26lr%3D%26sa%3DX)_** <registry_test id="wrt-9999" comment=“Account Lockout Duration Set to 5" check="at least 5">**
**- <object>**
**   ****<hive>****HKEY_LOCAL_MACHINE****</hive> **
**   ****<key>****Software\Microsoft\Windows****</key> **
**  ****<name>****AccountLockoutDuration****</name> **
**  ****</object>**
**- <data operation="AND">**
**  ****<value operator=“****greater than****">****5*****</value> **

**lpHKey = “****HKEY_LOCAL_MACHINE****”**
**Path = “****Software\Microsoft\Windows\”**
**Value = “****5****”**
**sKey = “****AccountLockoutDuration****”**
**Op = “****>****“**

- 800-53 Security Control
- DISA STIG

- 800-68 Security Guidance
- DISA Checklist
- NSA Guide

- SCAP Produced Security Guidance in XML Format

- COTS Tool Ingest

- API Call

## On the Schedule To Start

- Provide popular Windows XP Professional content (in Beta)
- DISA Gold
- DISA Platinum
- NIST 800-68
- NSA Guides
- Vendor
- Others as appropriate.
- Provide Microsoft Windows Vista
- As per the Microsoft Guide
- Tailored to Agency policy (if necessary)
- Provide Sun Solaris 10
- As per the jointly produced Sun Microsystems Security Guide
- Address Backlog beginning with
- Popular Desktop Applications
- Windows 2000
- Windows 2003
- Windows XP Home

## On The Web at:

- Security Content Automation Program:
- nvd.nist.gov/scap/scap.cfm
- NIST Checklist Website:
- checklists.nist.gov
- National Vulnerability Database:
- nvd.nist.gov

## Slide 23

## Slide 24

## Slide 25

## Mappings To Policy & Identifiers

- FISMA Security Controls (All 17 Families and 163 controls for reporting reasons)
- DoD IA Controls
- CCE Identifiers
- CVE Identifiers
- CVSS Scoring System
- DISA VMS Vulnerability IDs
- Gold Disk VIDs
- DISA VMS PDI IDs
- NSA References
- DCID
- IAVAs (TBD)
- ISO 1799

## NIST Publications

- NSA/DISA/NIST Security Automation Website.  SCAP.nist.gov.
- Revised Special Publication 800-70
- NIST IR  –Security Content Automation Program – *A Joint NSA, DISA, NIST Initiative.*
- NIST IR 7275 – XCCDF version 1.1.2 (Draft Posted)

## Common FISMA Statements

- While FISMA compliance is important, it can be complex and demanding.
- “Can parts of FISMA compliance be streamlined and automated”?
- “My organization spends more money on compliance than remediation”.

## Fundamental FISMA Questions

**What are the NIST Technical Security Controls?**

**What are the **_***Specific***_** NIST recommended settings for individual technical controls?**

**Am I compliant to NIST Recs & Can I use my COTS Product?**

**How do I implement the recommended setting for technical controls? Can I use my COTS Product?**

**Will I be audited against the same criteria I used to secure my systems?**

## FISMA Documents

**What are the NIST Technical Security Controls?**

**What are the **_***Specific***_** NIST recommended settings for individual technical controls?**

**Am I compliant to NIST Recs & Can I use my COTS Product?**

**How do I implement the recommended setting for technical controls? Can I use my COTS Product?**

**Will I be audited against the same criteria I used to secure my systems?**

** ****SP 800-53A / SP 800-26 **
**/ SP 800-37**

**Security Control Assessment**

** ****SP 800-53 / FIPS 200**
** ****/ SP 800-30**

**Security Control Refinement**

## Automation of FISMATechnical Controls

**What are the NIST Technical Security Controls?**

**What are the **_***Specific***_** NIST recommended settings for individual technical controls?**

**Am I compliant to NIST Recs & Can I use my COTS Product?**

**How do I implement the recommended setting for technical controls? Can I use my COTS Product?**

**Will I be audited against the same criteria I used to secure my systems?**

**NVD**

- COTS Tools

## How Many SP800-53 Controls Can Be Automated?

- Full Automation:       	 31 (19%)
- Partial Automation:   	 39 (24%)
- No Automation:        	 93 (57%)
-    Total Controls		163(100%)

- Note: These statistics apply to our proposed methodology.
- Other techniques may provide automation in different areas.

## Inside The Numbers

- Importance/Priority
- Securely configuring an IT system is of great importance.
- Complexity of Implementation
- Provide Common Framework
- Some controls require system-specific technical knowledge not always available in personnel.
- Labor
- Some Controls (i.e. AC-3, CM-6, etc.) require thousands of specific checks to ensure compliance.

## Combining Existing Initiatives

**DISA**
- STIG & Checklist Content
- Gold Disk & VMS Research
**FIRST**
- Common Vulnerability Scoring System (CVSS)
**MITRE **
- Common Vulnerability Enumeration (CVE)
- Common Configuration Enumeration (CCE)
- Open Vulnerability & Assessment Language (OVAL)
**NIST**
- National Vulnerability Database
- Checklist Program
- Content Automation Program
**NSA **
- Extensible Configuration Checklist Description Format (XCCDF)
- Security Guidance & Content

## Existing NIST Products

- National Vulnerability Database
- 2.2 million hits per month
- 20 new vulnerabilities per day
- Integrated standards:
- Checklist Program
- 115 separate guidance documents
- Covers 140 IT products

- 244 products

- 20 vendors

- 8 vendors
- 24 products

## National Vulnerability Database

- NVD is a comprehensive cyber security vulnerability database that:
- Integrates all publicly available U.S. Government vulnerability resources
- Provides references to industry resources.
- It is based on and synchronized with the CVE vulnerability naming standard.
- XML feed for all CVEs
- http://nvd.nist.gov

## Slide 37

## Slide 38

## NIST Checklist Program

- In response to NIST being named in the Cyber Security R&D Act of 2002.
- Encourage Vendor Development and Maintenance of Security Guidance.
- Currently Hosts 115 separate guidance documents for over 140 IT products.
- In English Prose and automation-enabling formats (i.e. .inf files, scripts, etc.)
- Need to provide configuration data in standard, consumable format.
- http://checklists.nist.gov

## eXtensible Configuration Checklist Description Format

- Designed to support:
- Information Interchange
- Document Generation
- Organizational and Situational Tailoring
- Automated Compliance Testing
- Compliance Scoring
- Published as NIST IR 7275
- Foster more widespread application of good security practices

## Involved

- Organizations

- Standards

- Integration
- Projects

- IT Security
- Vendors

**DOD COTS**
**Products**

**Who did I leave out?**

## Patches

- Standards

- Integration
- Projects

**We couple patches and**
**configuration checking**

**Configuration**

**Patches**

- CCE

## Security Measurement

- How secure is my computer?
- Measure security of the configuration
- Measure conformance to recommended application and OS security settings
- Measure the presence of security software (firewalls, antivirus...)
- Measure presence of vulnerabilities (needed patches)
- How well have I implemented the FISMA requirements (NIST SP800-53 technical controls)?
- Measure deviation from requirements
- Measure risk to the agency

## Setting Ground Truth/Defining Security

- 800-53

- Required technical security controls

- Low Level
- Checking
- Specification

- Security Specifications for Platforms
- And Application
-  Vulnerabilities
-  Required Configurations
-  Necessary Security Tools

- FISMA/FIPS 200

- List of all known
- vulnerabilities

- Secure
- Configuration
- Guidance

## Automated Security Measurement System

- Automated
- Measurement
- System

- Definition of
- What it means to
- Be Secure

- FISMA Security Requirements

- Vulnerability
- Checking Tools

- FIPS 199

- Deviation from
- Requirements

- Impact to the
- System

- Impact to the
- Agency

- Impact Scoring
- System

- Organizational Impact
- Rating

## Today’s Status

- NIST Windows XP Configuration Guide (SP 800-68)
- http://csrc.nist.gov/itsec/download_WinXP.html
- Policy statements represented in XCCDF
- Configuration checks represented in OVAL
- Currently Beta-3 version
- Covers: registry settings, file permission checks, password policies, account lockout policies, audit policies, etc.
- Download at: http://checklists.nist.gov/**NIST-800-68-WXPPro-XML-Beta-rev3.zip**
- Content will be updated periodically; however, format will remain constant.

## NIST 800-68 in Context of 800-53

-   800-53, Appendix D specifies security control applicability according to High, Moderate, and Low impact rating of an IT System.
-  800-68 provides specific configuration information according to environment (Standalone, Enterprise, SSLF, and Legacy)
-  The NIST XML specifies the applicable 800-68 security settings according to the 800-53 guidelines.
-  EXAMPLE:
-    AC-12 (session termination) is applicable for IT systems with either moderate or high impact rating, but not for system rated at a low.
-  The XCCDF profile for High and Moderate systems enables the group for AC-12 rule execution, but disables the group for low system.
-  The XCCDF rules ‘refer’ to the appropriate OVAL definitions in the companion OVAL file (named: WindowsXP-SP800-68.xml)

## Questions?

- Stephen Quinn (NIST Checklist Program)
- Peter Mell (National Vulnerability Database)
- Computer Security Division
- NIST, Information Technology Laboratory
- stquinn@nist.gov, mell@nist.gov