NIST SP800-117：SCAP 1.0指南：增强组织安全策略

需积分: 0 200 浏览量更新于2024-07-16 收藏 396KB PDF 举报

NIST SP800-117.pdf 是由美国国家标准与技术研究院（NIST）发布的指南，标题为《采纳和使用安全内容自动化协议（SCAP）版本1.0的建议》，作者包括 Stephen Quinn、Karen Scarfone、Matthew Barrett 和 Chris Johnson。这份文档的主要目的是概述SCAP Version 1.0的基本概念，并为组织提供如何利用SCAP功能增强其网络安全态势的方法。SCAP是一种标准化协议，用于自动化安全管理和检测，帮助企业和IT服务供应商在产品和服务中集成安全控制措施。文档的核心内容集中在以下几个方面： 1. **SCAP概述**：SCAP Version 1.0关注于通过标准化的方式定义和交流安全配置基线（CMB），包括操作系统、应用程序和网络设备的最佳安全设置。它为安全政策和控制提供了可操作的、跨平台的框架。 2. **组织采用指南**：文档为组织提供了如何采用SCAP，例如如何规划实施流程，选择和测试SCAP支持的工具，以及如何确保其与现有的安全管理系统（SMS）和操作流程兼容。 3. **IT产品和服务供应商的角色**：指南指导供应商如何在其产品和服务中集成SCAP，以便消费者可以更方便地应用和验证安全控制，这有助于提高整个供应链的安全性。 4. **版本更新**：文档强调，随着SCAP新版本的发布，这份指南会相应更新，以反映新的使用实践和标准变化。 5. **范围限制**：虽然SCAP主要用于安全配置管理，但它并不涉及非安全目的的配置管理，如软件功能性和性能。此外，它主要关注部署软件的运营环境，不涉及软件开发阶段的安全问题。 6. **出版背景**：NIST Computer Security Division 的 Information Technology Laboratory (ITL) 发布这份报告，旨在促进国家测量和标准基础设施的发展，提升美国经济和公众福祉，通过提供技术领导来加强计算机系统的安全性。 NIST SP800-117.pdf 是一个关键资源，对于理解SCAP在组织层面的应用、产品和服务供应商如何整合SCAP以及如何跟踪最新版本变化都具有重要价值。通过遵循这份指南，企业可以更加系统化和自动化地实现和维护其网络安全策略。

GUIDE TO ADOPTING AND USING THE SECURITY CONTENT AUTOMATION PROTOCOL (SCAP) VERSION 1.0

iii

Table of Contents

Executive Summary ............................................................................................................ ES-1

1. Introduction ................................................................................................................... 1-1

1.1 Authority .................................................................................................................1-1

1.2 Purpose and Scope ................................................................................................1-1

1.3 Audience ................................................................................................................1-1

1.4 Document Structure ...............................................................................................1-1

2. SCAP Overview ............................................................................................................. 2-1

2.1 The Motivation for Creating SCAP ..........................................................................2-1

2.2 The Definition of SCAP ...........................................................................................2-2

2.3 NIST SCAP Product Validation and Laboratory Accreditation Programs ................2-3

3. Recommendations for Common Uses of SCAP .......................................................... 3-1

3.1 Security Configuration Verification ..........................................................................3-1

3.2 Requirements Traceability ......................................................................................3-3

3.3 Standardized Security Enumerations ......................................................................3-3

3.4 Vulnerability Measurement .....................................................................................3-4

3.5 Security Data Analytics ...........................................................................................3-5

4. Recommendations for Vendor and Service Adoption of SCAP ................................. 4-1

4.1 Software Developers ..............................................................................................4-1

4.2 SCAP Content Producers .......................................................................................4-1

Appendix A— Details on Using SCAP for FISMA Compliance .......................................... A-1

Appendix B— Acronyms and Abbreviations ...................................................................... B-1

Appendix C— SCAP Resources........................................................................................... C-1

List of Tables

Table 2-1. SCAP Version 1.0 Components ............................................................................. 2-3

Table A-1. Example of Minimum Password Lengths by Impact and Environment ................... A-2

Table A-2. Examples of Rule Usage for Windows XP Professional Profiles ............................ A-3

Table C-1. SCAP Component Specifications .......................................................................... C-1

Table C-2. Other SCAP Resources ......................................................................................... C-1

GUIDE TO ADOPTING AND USING THE SECURITY CONTENT AUTOMATION PROTOCOL (SCAP) VERSION 1.0

ES-1

Executive Summary

Managing the security of systems throughout an enterprise is challenging for several reasons. Most

organizations have many systems to patch and configure securely, with numerous pieces of software

(operating systems and applications) to be secured on each system. Organizations need to conduct

continuous monitoring of the security configuration of each system and be able to determine the security

posture of systems and the organization at any given time. Organizations also need to demonstrate

compliance with various sets of security requirements, such as the Federal Information Security

Management Act (FISMA), which is mandated by the U.S. Government for its agencies. All of these

tasks are extremely time-consuming and error-prone because there has been no standardized, automated

way of performing them. Another problem for organizations is the lack of interoperability across security

tools; for example, the use of proprietary names for vulnerabilities or platforms creates inconsistencies in

reports from multiple tools, which can cause delays in security assessment, decision-making, and

vulnerability remediation.

Organizations need standardized, automated approaches to overcoming these challenges, and the Security

Content Automation Protocol (SCAP) was developed to help address this. The definition for SCAP

(pronounced ess-cap), as expressed in NIST Special Publication (SP) 800-126, is ―a suite of specifications

that standardize the format and nomenclature by which security software products communicate software

flaw and security configuration information.‖ SCAP is designed to organize, express, and measure

security-related information in standardized ways, as well as related reference data, such as identifiers for

post-compilation software flaws and security configuration issues. SCAP can be used to maintain the

security of enterprise systems, such as automatically verifying the installation of patches, checking system

security configuration settings, and examining systems for signs of compromise. Individual specifications

that comprise SCAP can also be used for forensic activities and other purposes.

This document describes common uses of SCAP and makes recommendations for SCAP users. The

document also provides insights to IT product and service vendors about adopting SCAP in their

offerings. SCAP does not replace existing security software; rather, support for it can be embedded into

existing software.

To take advantage of SCAP’s capabilities, organizations should follow these recommendations:

Organizations should use security configuration checklists that are expressed using SCAP to

improve and monitor their systems’ security.

A security configuration checklist that is expressed using SCAP, otherwise known as an SCAP-

expressed

checklist, documents desired security configuration settings, installed patches, and other

system security elements in a standardized format. Organizations should identify and obtain SCAP-

expressed checklists relevant for their systems’ software, then customize the checklists as appropriate to

meet specific organizational requirements. After fully testing the checklists, organizations should

implement their recommendations. (The current version of SCAP does not provide a capability to

automatically implement checklists. However, SCAP-expressed checklists can be applied today using

proprietary methods, and NIST plans on enhancing SCAP to provide standardized implementation

methods.) Organizations should use SCAP-expressed checklists on an ongoing basis to confirm that

systems are configured properly. Federal agencies should use SCAP-expressed checklists to ensure

conformance to NIST and OMB security configuration guidance.

SCAP-expressed content conforms to the requirements specified in NIST SP 800-126 and can be tested for compliance to

SP 800-126 using the NIST-provided software located at http://scap.nist.gov/content.

剩余25页未读，继续阅读

艾米的爸爸

粉丝: 798
资源: 314

NIST SP800-117：SCAP 1.0指南：增强组织安全策略

NIST SP800-177r1.pdf

NIST SP800-30信息安全文档

NIST SP800-153.pdf

NIST SP800-108.pdf

NIST SP800-29.pdf

NIST SP800-123.pdf

NIST SP800-113.pdf

NIST SP800-41.pdf

NIST SP800-63.pdf

NIST SP800-122.pdf

最新资源