Information Security Continuous Monitoring (ISCM) for Federal Information Systems and Organizations
APPENDIX D > D.3.2 REFERENCE DATA SOURCES

D.3.2 REFERENCE DATA SOURCES

NIST provides the two data repositories, the NVD and security configuration checklists, to
support both automated and manual ISCM efforts.
National Vulnerability Database (NVD)
The NVD is the U.S. government repository of standards-based vulnerability management data
represented using the SCAP specifications. This data enables automation of vulnerability
management, security measurement, and compliance. The NVD includes security checklists,
security-related software flaws, misconfigurations, product names, and impact metrics.
The content in the NVD is dynamic; for example, vulnerabilities are updated with new
information such as patch content, checklists are updated, and new checklists are added. As
information becomes available in the NVD, systems are rescanned to reassess risk and mitigate
any new vulnerabilities. To facilitate a standardized distribution of the data, vulnerability content
in the form of XML data feeds is available and updated at two-hour intervals. Organizations can
leverage this standardized data for ISCM automation by configuring scheduled scans of systems
and evaluating changes that may have occurred and any associated security risks from the
changes.
Security Configuration Checklists
The Cyber Security Research and Development Act of 200255 tasked NIST to "develop, and
revise as necessary, a checklist setting forth settings and option selections that minimize the
security risks associated with each computer hardware or software system that is, or is likely to
become widely used within the Federal Government." The National Checklist Program (NCP)56
A security configuration checklist, sometimes referred to as a lockdown guide, hardening guide,
or benchmark configuration, is essentially a document that contains instructions or procedures for
configuring an information technology (IT) product to a baseline level of security. Checklists can
be developed not only by IT vendors, but also by consortia, academia, and industry, federal
agencies and other governmental organizations, and others in the public and private sectors.
is
the U.S. government repository of publicly available security checklists. The use of such
checklists within the context of an overarching information security program can markedly
reduce the vulnerability exposure of an organization.
The NCP provides checklists both in prose format and in SCAP-expressed format. The SCAP-
expressed checklists allow SCAP-validated tools to process the checklists and scan systems
automatically. A subset of checklists also provides embedded Common Configuration
Enumerations (CCEs) mapped to the NIST SP 800-53 security controls that allow for checklist
results to be returned in the context of NIST SP 800-53 control requirements. A checklist might
include any of the following:
•
Configuration files that automatically set various security settings (e.g., executables, security
templates that modify settings, scripts);
55 The Cyber Security Research and Development Act of 2002 is available at
http://csrc.nist.gov/drivers/documents/HR3394-final.pdf.
56 For more information on the NCP, see http://web.nvd.nist.gov/view/ncp/repository.