Subject: [sacm] SACM/CCE terminology in other compliance frameworks

From: [email-masked]
Date: Sat, 27 Oct 2012 17:48:48 -0500 (CDT)

Chandra and all:

I see this as a step in the right direction.

CobiT has a full spreadsheet mapping of their compliance requirements to SP 800-53 (under research).  The "CobiT CCE" that Chandra suggests is a good marketing idea in my opinion.

I do not know that PCI-DSS has been mapped to SP 800-53, but the "pcidss CCE" is also a new interesting idea (opinion also).

However, I see SACM product capabilities as a "scan-once and map to any compliance model" strategy.

The "CCE to other compliance models" can only be achieved with SP 800-53 to other compliance model mappings.

The mappings will probably be a springboard for vendors to make their products relevant to organizations needing to comply with governance models other than FISMA.

Notetworthy and of marketting value for international business is that, for semi-automatable compliance requirements, they can use SACM/OCIL.

I also would like to emphasize that SCAP content and SCAP products that can map to governance compliance models are tier IV (as specified in SP 800-70)

David Oliva

-----Original Message-----
From: Chandrashekhar B [mailto:[email-masked]]
Sent: Wednesday, October 24, 2012 2:52 AM
To: 'Luis Nunez'; 'Adam Montville'
Cc: SCAP-DEV; [email-masked]; [email-masked]
Subject: Re: [sacm] [scap_interest] Just throwing this out there: Compliance Frameworks

Hello All,

We used the NIST 800-53 - CCE mappings
(http://static.nvd.nist.gov/feeds/xml/cce/nvdcce-0.1-feed.xml) and incorporated this into the CCEs reference in SCAP Repo (www.scaprepo.com).
We can now search based on the 800-53 control ID's like AC-3, CM-6 etc and list the CCEs that map to it.

And we also used the CCM (Cloud Control Matrix) mappings to NIST 800-53 and to other regulatory standards and arrived at CCEs related to each regulatory standard. We can now search for "pcidss cce" or "COBIT CCE", for example.
The objective is to arrive at common set of technical requirements for each of the regulatory standard and hence the mapping to CCE.

Thanks to Luis and Cloud Security Alliance.

As a next step, we took up an exercise to map individual regulatory requirements to the right CCEs and started with NERC CIP to CCE mapping. If there is any interest in this work or any collaboration possibility, we would be happy to work together, please mail me.

Thanks,
Chandra.

-----Original Message-----
From: [email-masked] [mailto:[email-masked]]
On Behalf Of Luis Nunez
Sent: Wednesday, February 15, 2012 2:47 AM
To: Adam Montville
Cc: [email-masked]
Subject: Re: [scap_interest] Just throwing this out there: Compliance Frameworks

Another reference point is the Cloud Control Matrix. They did a excellent job of mapping many of the regulatories into a common set.
Coming out the Cloud Security Alliance it looks like it is gear towards Cloud environments. Wondering if it could be leveraged in any environments.

Link: https://cloudsecurityalliance.org/research/ccm/

-ln

On Feb 14, 2012, at 4:09 PM, Adam Montville wrote:

> All,
>
> I had a brief discussion with several members of this list with
> respect to
compliance frameworks, which met some resistance. Still, I think presenting the idea to a larger audience to solicit feedback is a good idea.
>
> From an automation perspective, it seems that some method of being
> able to
map benchmark-level tests to some higher level policy representation may be warranted. At the end of the day, we perform assessments to ensure that we are in a secure state - to be compliant with a particular set of policies.
>
> Is there any interest in being able to represent a compliance
> framework
with either a new specification or potentially revitalizing and extending an existing specification (CCI: http://iase.disa.mil/stigs/cci.html), or to simply rely upon any existing commercial efforts, such as UCF (https://www.unifiedcompliance.com)?
>
> Or, is this type of representation simply not needed - there's enough
there, the present demand doesn't justify the work, or something else?
>
> Thoughts?
>
> Regards,
>
> Adam W. Montville | Security and Compliance Architect
>
> Direct: 503 276-7661
> Mobile: 360 471-7815
>
> TRIPWIRE | Take CONTROL
> http://www.tripwire.com
>
> _______________________________________________
> scap_interest mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/scap_interest

_______________________________________________
scap_interest mailing list
[email-masked]
https://www.ietf.org/mailman/listinfo/scap_interest
-----
No virus found in this message.
Checked by AVG - www.avg.com
Version: 2012.0.2197 / Virus Database: 2437/5207 - Release Date: 08/18/12

---

From: "Chandrashekhar B" <[email-masked]>
Date: Tue, 30 Oct 2012 19:47:16 +0530

David,

Comments inline…

From: [email-masked] [mailto:[email-masked]] 
Sent: Sunday, October 28, 2012 4:19 AM
To: [email-masked]; [email-masked]
Subject: SACM/CCE terminology in other compliance frameworks

Chandra and all:

This is very useful, do you have a link for the CobiT to 800-53 mappings?

Good idea! If all compliance model map to SP 800-53, which would in-turn allows us to reach to the CCEs. 

David Oliva

-----Original Message-----
From: Chandrashekhar B [mailto:[email-masked]] 
Sent: Wednesday, October 24, 2012 2:52 AM
To: 'Luis Nunez'; 'Adam Montville'
Cc: SCAP-DEV; [email-masked]; [email-masked]
Subject: Re: [sacm] [scap_interest] Just throwing this out there: Compliance Frameworks

Hello All,

We used the NIST 800-53 - CCE mappings
(http://static.nvd.nist.gov/feeds/xml/cce/nvdcce-0.1-feed.xml) and incorporated this into the CCEs reference in SCAP Repo (www.scaprepo.com <http://www.scaprepo.com/> ).
We can now search based on the 800-53 control ID's like AC-3, CM-6 etc and list the CCEs that map to it.

Thanks,
Chandra.

-----Original Message-----

-ln

> Is there any interest in being able to represent a compliance 
with either a new specification or potentially revitalizing and extending an existing specification (CCI: http://iase.disa.mil/stigs/cci.html), or to simply rely upon any existing commercial efforts, such as UCF (https://www.unifiedcompliance.com <https://www.unifiedcompliance.com/> )?
> http://www.tripwire.com <http://www.tripwire.com/> 
> 

Checked by AVG - www.avg.com <http://www.avg.com/> 

  _____  

No virus found in this message.
Checked by AVG - www.avg.com
Version: 2013.0.2742 / Virus Database: 2617/5856 - Release Date: 10/26/12