Subject: Re: [sacm] [scap_interest] Just throwing this out there: Compliance Frameworks

From: "Chandrashekhar B" <[email-masked]>
Date: Wed, 24 Oct 2012 12:22:14 +0530

Hello All,

We used the NIST 800-53 - CCE mappings
(http://static.nvd.nist.gov/feeds/xml/cce/nvdcce-0.1-feed.xml) and
incorporated this into the CCEs reference in SCAP Repo (www.scaprepo.com).
We can now search based on the 800-53 control ID's like AC-3, CM-6 etc and
list the CCEs that map to it.

And we also used the CCM (Cloud Control Matrix) mappings to NIST 800-53 and
to other regulatory standards and arrived at CCEs related to each regulatory
standard. We can now search for "pcidss cce" or "COBIT CCE", for example.
The objective is to arrive at common set of technical requirements for each
of the regulatory standard and hence the mapping to CCE. 

Thanks to Luis and Cloud Security Alliance. 

As a next step, we took up an exercise to map individual regulatory
requirements to the right CCEs and started with NERC CIP to CCE mapping. If
there is any interest in this work or any collaboration possibility, we
would be happy to work together, please mail me. 

Thanks,
Chandra.

-----Original Message-----
From: [email-masked] [mailto:[email-masked]]
On Behalf Of Luis Nunez
Sent: Wednesday, February 15, 2012 2:47 AM
To: Adam Montville
Cc: [email-masked]
Subject: Re: [scap_interest] Just throwing this out there: Compliance
Frameworks

Another reference point is the Cloud Control Matrix.  They did a excellent
job of mapping many of the regulatories into a common set.
Coming out the Cloud Security Alliance it looks like it is gear towards
Cloud environments.  Wondering if it could be leveraged in any environments.

Link: https://cloudsecurityalliance.org/research/ccm/

-ln

On Feb 14, 2012, at 4:09 PM, Adam Montville wrote:

> All,
> 
> I had a brief discussion with several members of this list with respect to
compliance frameworks, which met some resistance.  Still, I think presenting
the idea to a larger audience to solicit feedback is a good idea.
> 
> From an automation perspective, it seems that some method of being able to
map benchmark-level tests to some higher level policy representation may be
warranted.  At the end of the day, we perform assessments to ensure that we
are in a secure state - to be compliant with a particular set of policies.
> 
> Is there any interest in being able to represent a compliance framework
with either a new specification or potentially revitalizing and extending an
existing specification (CCI: http://iase.disa.mil/stigs/cci.html), or to
simply rely upon any existing commercial efforts, such as UCF
(https://www.unifiedcompliance.com)?
> 
> Or, is this type of representation simply not needed - there's enough
there, the present demand doesn't justify the work, or something else?
> 
> Thoughts?
> 
> Regards,
> 
> Adam W. Montville | Security and Compliance Architect
> 
> Direct: 503 276-7661
> Mobile: 360 471-7815
> 
> TRIPWIRE | Take CONTROL
> http://www.tripwire.com
> 
> _______________________________________________
> scap_interest mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/scap_interest

_______________________________________________
scap_interest mailing list
[email-masked]
https://www.ietf.org/mailman/listinfo/scap_interest
-----
No virus found in this message.
Checked by AVG - www.avg.com
Version: 2012.0.2197 / Virus Database: 2437/5207 - Release Date: 08/18/12

---

From: "Haynes, Dan" <[email-masked]>
Date: Mon, 29 Oct 2012 10:53:23 +0000

Hi Rob,

In addition to the list of SCAP Validated Products (http://nvd.nist.gov/scapproducts.cfm), you may also want to check out the list of products participating in the OVAL Adoption Program (http://oval.mitre.org/adoption/participants.html).  There is a fair amount of overlap between the two lists, but, you may find something that fits your needs.

Thanks,

Danny

>From: [email-masked] [mailto:[email-masked]] On
>Behalf Of Robert Rota (CONT)
>Sent: Friday, October 26, 2012 2:02 PM
>To: 'SCAP-DEV'; [email-masked]; [email-masked]
>Subject: [scap-dev] Vulnerability Scanner with SCAP formatted audits?
>
>Hello,
>
>Is anyone aware of a vulnerability scanner that has the number of checks
>comparable to Retina or Nessus that has all of the checks in a SCAP format?
>Retina is xml but not SCAP and Nessus is .audit. I know they can import SCAP
>format but that is not what I need. DoD has mandatory tools that will import
>SCAP but I can't find a comprehensive vulnerability scan (patches,
>zero-days, etc.) in SCAP format that I can use?
>
>I spoke with a few guys that tried to convert the Nessus and Retina checks
>to SCAP with a dead end once the checks were too dependent on the scan
>engine.
>
>Any help would be appreciated. Or, please forward to a more appropriate
>group. I am aware of the list on the NIST NVD site but these are SCAP
>compliant importers that don't have all of their proprietary checks in SCAP
>format.
>
>
>Thanks!
>
>
>Rob
>--
>Robert Rota <[email-masked]>
>SPAWAR Network Security
>Contractor, SAIC CISBU
>SSC Pacific Tel#  619-553-1523
>Mobile Tel# 619-405-8979
>
>"Everything that I ever knew - my life, my loved ones, the Navy -
>everything, the whole world was behind my thumb." -James Lovell
>

---

From: "Chandrashekhar B" <[email-masked]>
Date: Mon, 29 Oct 2012 21:20:13 +0530

Hello Robert,

If you are looking at SCAP content that you can import into an SCAP enabled
scanner, we have pretty good coverage for the vulnerability and patch
detection in SCAP format. You could look at www.scaprepo.com for more
details or mail me.

Thanks,
Chandra.

-----Original Message-----
From: [email-masked] [mailto:[email-masked]] On Behalf
Of Robert Rota (CONT)
Sent: Friday, October 26, 2012 11:32 PM
To: 'SCAP-DEV'; [email-masked]; [email-masked]
Subject: [scap-dev] Vulnerability Scanner with SCAP formatted audits?

Hello,

Thanks!

Rob

-----
No virus found in this message.
Checked by AVG - www.avg.com
Version: 2013.0.2741 / Virus Database: 2616/5846 - Release Date: 10/21/12