Subject: [scap_interest] Just throwing this out there: Compliance Frameworks

From: Adam Montville <[email-masked]>
Date: Tue, 14 Feb 2012 21:09:34 +0000

All,

I had a brief discussion with several members of this list with respect to compliance frameworks, which met some resistance.  Still, I think presenting the idea to a larger audience to solicit feedback is a good idea.

>From an automation perspective, it seems that some method of being able to map benchmark-level tests to some higher level policy representation may be warranted.  At the end of the day, we perform assessments to ensure that we are in a secure state – to be compliant with a particular set of policies.

Is there any interest in being able to represent a compliance framework with either a new specification or potentially revitalizing and extending an existing specification (CCI: http://iase.disa.mil/stigs/cci.html), or to simply rely upon any existing commercial efforts, such as UCF (https://www.unifiedcompliance.com)?

Or, is this type of representation simply not needed – there's enough there, the present demand doesn't justify the work, or something else?

Thoughts?

Regards,

Adam W. Montville | Security and Compliance Architect

Direct: 503 276-7661
Mobile: 360 471-7815

TRIPWIRE | Take CONTROL
http://www.tripwire.com

---

From: Luis Nunez <[email-masked]>
Date: Tue, 14 Feb 2012 16:16:30 -0500

Another reference point is the Cloud Control Matrix.  They did a excellent job of mapping many of the regulatories into a common set.
Coming out the Cloud Security Alliance it looks like it is gear towards Cloud environments.  Wondering if it could be leveraged in any environments. 

Link: https://cloudsecurityalliance.org/research/ccm/

-ln

On Feb 14, 2012, at 4:09 PM, Adam Montville wrote:

> _______________________________________________
> scap_interest mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/scap_interest

---

From: <[email-masked]>
Date: Tue, 14 Feb 2012 15:47:29 -0600

Adam,

I agree that an effort such as this has great potential.  Think of the content authors today. They use XML Editors or internally developed tools to create OVAL to do the compliance checking.  This is very time consuming and very costly, while limiting the available checks and benchmarks.

If there was a means where all regulations and security policies could be universally mapped and the specifics around them, based on individual platforms, were also attached to each unified record, it is possible to auto generate not just the benchmarks but the individual checks.  Some of this research has been successful in the past.  This is doable. The problem has been there is not an authoritative source for that data.

Today too many people are manually writing content that could be auto generated from a database with the right schema and software.  The problem though is as much on the front end as it is on the generation side.  Someone needs to maintain that information or have an infrastructure put in place where guidance authors for regulations or security policies can update their information in the shared datastore.

I think this is one of the missing pieces and it may be useful to have a discussion with interested parties but you would need to include participants from the two mentioned efforts below.

Kent Landfield
Director Content Strategy, Architecture and Standards

McAfee | An Intel Company
5000 Headquarters Dr.
Plano, Texas 75024

Direct: +1.972.963.7096
Mobile: +1.817.637.8026
Web: www.mcafee.com<http://www.mcafee.com/>

From: Adam Montville <[email-masked]<mailto:[email-masked]>>
Date: Tue, 14 Feb 2012 15:09:34 -0600
To: "[email-masked]<mailto:[email-masked]>" <[email-masked]<mailto:[email-masked]>>
Subject: [scap_interest] Just throwing this out there: Compliance Frameworks

All,

Thoughts?

Regards,

Direct: 503 276-7661
Mobile: 360 471-7815

TRIPWIRE | Take CONTROL
http://www.tripwire.com

_______________________________________________
scap_interest mailing list
[email-masked]<mailto:[email-masked]>
https://www.ietf.org/mailman/listinfo/scap_interest

---

From: Adam Montville <[email-masked]>
Date: Wed, 15 Feb 2012 14:24:33 +0000

Hello,

If you're not already aware, there is an effort underway to migrate security automation development to the Internet Engineering Task Force.  I have proposed that part of that effort seek to expand how frameworks can be represented.  I believe that CCI and/or  UCF formats may be of use and invite you to join the discussion at [email-masked]: https://www.ietf.org/mailman/listinfo/scap_interest.

There is a need to accurately represent frameworks, and I'd like to see DISA and UCF join in the discussion.

If you have any comments, questions, or concerns, feel free to contact me directly.

Regards,

Direct: 503 276-7661
Mobile: 360 471-7815

TRIPWIRE | Take CONTROL
http://www.tripwire.com

From: kent_landfield <[email-masked]<mailto:[email-masked]>>
Date: Tue, 14 Feb 2012 15:47:29 -0600
To: Adam Montville <[email-masked]<mailto:[email-masked]>>, <[email-masked]<mailto:[email-masked]>>
Subject: Re: [scap_interest] Just throwing this out there: Compliance Frameworks

Adam,

Kent Landfield

Direct: +1.972.963.7096
Mobile: +1.817.637.8026

All,

Thoughts?

Regards,

Direct: 503 276-7661
Mobile: 360 471-7815

TRIPWIRE | Take CONTROL
http://www.tripwire.com

---

From: Dorian Cougias <[email-masked]>
Date: Wed, 15 Feb 2012 08:08:28 -0800

We at the UCF believe that we can work together with the IETF, or any other organization, to ensure that our commercial mapping efforts and those performed in the public sector can co-exist and be mutually beneficial to each other's efforts.

Dorian J. Cougias
Compliance Scientist
Unified Compliance Framework

---- On Wed, 15 Feb 2012 06:24:33 -0800 Adam Montville &lt;[email-masked]&gt; wrote ---- 

Hello, 

 
 
Regards, 

Direct: 503 276-7661 
Mobile: 360 471-7815 
 
TRIPWIRE | Take CONTROL 
http://www.tripwire.com 
 
From: kent_landfield &lt;[email-masked]&lt;mailto:[email-masked]&gt;&gt; 
Date: Tue, 14 Feb 2012 15:47:29 -0600 
To: Adam Montville &lt;[email-masked]&lt;mailto:[email-masked]&gt;&gt;, &lt;[email-masked]&lt;mailto:[email-masked]&gt;&gt; 
Subject: Re: [scap_interest] Just throwing this out there: Compliance Frameworks 
 
Adam, 

 

Kent Landfield 

Direct: +1.972.963.7096 
Mobile: +1.817.637.8026 
Web: www.mcafee.com&lt;http://www.mcafee.com/&gt; 
 
From: Adam Montville &lt;[email-masked]&lt;mailto:[email-masked]&gt;&gt; 
Date: Tue, 14 Feb 2012 15:09:34 -0600 
To: "[email-masked]&lt;mailto:[email-masked]&gt;" &lt;[email-masked]&lt;mailto:[email-masked]&gt;&gt; 
Subject: [scap_interest] Just throwing this out there: Compliance Frameworks 
 
All, 

 

Thoughts? 
 
Regards, 

Direct: 503 276-7661 
Mobile: 360 471-7815 
 
TRIPWIRE | Take CONTROL 
http://www.tripwire.com 
 
_______________________________________________ 
scap_interest mailing list 
[email-masked]&lt;mailto:[email-masked]&gt; 
https://www.ietf.org/mailman/listinfo/scap_interest

---

From: Adam Montville <[email-masked]>
Date: Wed, 15 Feb 2012 16:53:02 +0000

Can we then expect that UCF will be contributing to the effort?  I think our thoughts with respect to representing frameworks and controls would be well-informed by UCF's experience.

Adam

From: Dorian Cougias <[email-masked]<mailto:[email-masked]>>
Date: Wed, 15 Feb 2012 08:08:28 -0800
To: Adam Montville <[email-masked]<mailto:[email-masked]>>
Cc: <[email-masked]<mailto:[email-masked]>>, <[email-masked]<mailto:[email-masked]>>, kent_landfield <[email-masked]<mailto:[email-masked]>>, <[email-masked]<mailto:[email-masked]>>
Subject: Re: FW: [scap_interest] Just throwing this out there: Compliance Frameworks

---

From: Dorian Cougias <[email-masked]>
Date: Wed, 15 Feb 2012 09:03:43 -0800

Yes. I've signed up on the list and will contribute as much as you'd like.

This might dovetail in very well with our Online Mapping Tool effort we are beginning to release this year.

Dorian J. Cougias
Compliance Scientist

---- On Wed, 15 Feb 2012 08:53:02 -0800 Adam Montville&lt;[email-masked]&gt; wrote ---- 

Adam 
 
From: Dorian Cougias &lt;[email-masked]&lt;mailto:[email-masked]&gt;&gt; 
Date: Wed, 15 Feb 2012 08:08:28 -0800 
To: Adam Montville &lt;[email-masked]&lt;mailto:[email-masked]&gt;&gt; 
Cc: &lt;[email-masked]&lt;mailto:[email-masked]&gt;&gt;, &lt;[email-masked]&lt;mailto:[email-masked]&gt;&gt;, kent_landfield &lt;[email-masked]&lt;mailto:[email-masked]&gt;&gt;, &lt;[email-masked]&lt;mailto:[email-masked]&gt;&gt; 
Subject: Re: FW: [scap_interest] Just throwing this out there: Compliance Frameworks

---

From: Adam Montville <[email-masked]>
Date: Wed, 15 Feb 2012 17:05:40 +0000

Excellent!  Good to have you here.

From: Dorian Cougias <[email-masked]<mailto:[email-masked]>>
Date: Wed, 15 Feb 2012 09:03:43 -0800
To: Adam Montville <[email-masked]<mailto:[email-masked]>>
Cc: "[email-masked]<mailto:[email-masked]>" <[email-masked]<mailto:[email-masked]>>, "[email-masked]<mailto:[email-masked]>" <[email-masked]<mailto:[email-masked]>>, kent_landfield <[email-masked]<mailto:[email-masked]>>, "[email-masked]<mailto:[email-masked]>" <[email-masked]<mailto:[email-masked]>>
Subject: Re: [scap_interest] Just throwing this out there: Compliance Frameworks

Dorian J. Cougias
Compliance Scientist

---- On Wed, 15 Feb 2012 08:53:02 -0800 Adam Montville<[email-masked]<mailto:[email-masked]>> wrote ----

Adam

From: Dorian Cougias <[email-masked]<mailto:[email-masked]><mailto:[email-masked]>>
Date: Wed, 15 Feb 2012 08:08:28 -0800
To: Adam Montville <[email-masked]<mailto:[email-masked]><mailto:[email-masked]>>
Cc: <[email-masked]<mailto:[email-masked]><mailto:[email-masked]>>, <[email-masked]<mailto:[email-masked]><mailto:[email-masked]>>, kent_landfield <[email-masked]<mailto:[email-masked]><mailto:[email-masked]>>, <[email-masked]<mailto:[email-masked]><mailto:[email-masked]>>
Subject: Re: FW: [scap_interest] Just throwing this out there: Compliance Frameworks