Re: [scap_interest] FW: Just throwing this out there: Compliance Frameworks

We at the UCF believe that we can work together with the IETF, or any other organization, to ensure that our commercial mapping efforts and those performed in the public sector can co-exist and be mutually beneficial to each other's efforts.

Dorian J. Cougias
Compliance Scientist
Unified Compliance Framework

---- On Wed, 15 Feb 2012 06:24:33 -0800 Adam Montville &lt;amontville@tripwire.com&gt; wrote ---- 

Hello, 

If you're not already aware, there is an effort underway to migrate security automation development to the Internet Engineering Task Force. I have proposed that part of that effort seek to expand how frameworks can be represented. I believe that CCI and/or UCF formats may be of use and invite you to join the discussion at scap_interest@itef.org: https://www.ietf.org/mailman/listinfo/scap_interest. 

There is a need to accurately represent frameworks, and I'd like to see DISA and UCF join in the discussion. 

If you have any comments, questions, or concerns, feel free to contact me directly. 

Regards, 

Adam W. Montville | Security and Compliance Architect 

Direct: 503 276-7661 
Mobile: 360 471-7815 

TRIPWIRE | Take CONTROL 
http://www.tripwire.com 

From: kent_landfield &lt;kent_landfield@mcafee.com&lt;mailto:kent_landfield@mcafee.com&gt;&gt; 
Date: Tue, 14 Feb 2012 15:47:29 -0600 
To: Adam Montville &lt;amontville@tripwire.com&lt;mailto:amontville@tripwire.com&gt;&gt;, &lt;scap_interest@ietf.org&lt;mailto:scap_interest@ietf.org&gt;&gt; 
Subject: Re: [scap_interest] Just throwing this out there: Compliance Frameworks 

Adam, 

I agree that an effort such as this has great potential. Think of the content authors today. They use XML Editors or internally developed tools to create OVAL to do the compliance checking. This is very time consuming and very costly, while limiting the available checks and benchmarks. 

If there was a means where all regulations and security policies could be universally mapped and the specifics around them, based on individual platforms, were also attached to each unified record, it is possible to auto generate not just the benchmarks but the individual checks. Some of this research has been successful in the past. This is doable. The problem has been there is not an authoritative source for that data. 

Today too many people are manually writing content that could be auto generated from a database with the right schema and software. The problem though is as much on the front end as it is on the generation side. Someone needs to maintain that information or have an infrastructure put in place where guidance authors for regulations or security policies can update their information in the shared datastore. 

I think this is one of the missing pieces and it may be useful to have a discussion with interested parties but you would need to include participants from the two mentioned efforts below. 

Kent Landfield 
Director Content Strategy, Architecture and Standards 

McAfee | An Intel Company 
5000 Headquarters Dr. 
Plano, Texas 75024 

Direct: +1.972.963.7096 
Mobile: +1.817.637.8026 
Web: www.mcafee.com&lt;http://www.mcafee.com/&gt; 

From: Adam Montville &lt;amontville@tripwire.com&lt;mailto:amontville@tripwire.com&gt;&gt; 
Date: Tue, 14 Feb 2012 15:09:34 -0600 
To: "scap_interest@ietf.org&lt;mailto:scap_interest@ietf.org&gt;" &lt;scap_interest@ietf.org&lt;mailto:scap_interest@ietf.org&gt;&gt; 
Subject: [scap_interest] Just throwing this out there: Compliance Frameworks 

All, 

I had a brief discussion with several members of this list with respect to compliance frameworks, which met some resistance. Still, I think presenting the idea to a larger audience to solicit feedback is a good idea. 

>From an automation perspective, it seems that some method of being able to map benchmark-level tests to some higher level policy representation may be warranted. At the end of the day, we perform assessments to ensure that we are in a secure state – to be compliant with a particular set of policies. 

Is there any interest in being able to represent a compliance framework with either a new specification or potentially revitalizing and extending an existing specification (CCI: http://iase.disa.mil/stigs/cci.html), or to simply rely upon any existing commercial efforts, such as UCF (https://www.unifiedcompliance.com)? 

Or, is this type of representation simply not needed – there's enough there, the present demand doesn't justify the work, or something else? 

Thoughts? 

Regards, 

Adam W. Montville | Security and Compliance Architect 

Direct: 503 276-7661 
Mobile: 360 471-7815 

TRIPWIRE | Take CONTROL 
http://www.tripwire.com 

_______________________________________________ 
scap_interest mailing list 
scap_interest@ietf.org&lt;mailto:scap_interest@ietf.org&gt; 
https://www.ietf.org/mailman/listinfo/scap_interest 