| NIST and NSA develop common specification language for writing security checklists and related documents
Increasingly, computers and other information technology products are vulnerable to multiple threats including viruses, worms and identity or information theft. One basic, yet effective, security tool is the security configuration checklist--a series of instructions for configuring an information technology (IT) product to a baseline or benchmark level of security. Configuring a system into conformance with a benchmark or other security specification is a time-consuming and very technical task. Automated tools are available to help system administrators determine a system's conformance and recommend corrective measures. However, most of these tools are designed for a particular IT product or system. XCCDF is an XML-based format that is flexible, vendor-neutral and suited for a wide variety of checklist applications including measuring conformance of an IT system to security benchmarks and generating a record of a benchmark test. (XML is a language - analogous to the HTML codes used to format web pages - that describes information in a standard way to allow computers to exchange information and act on it.) "XCCDF's common format will help security professionals, vendors and system auditors to more quickly exchange information and improve automation of security testing and configuration checking," said John Wack, a researcher in NIST's Computer Security Division. The XCCDF specification document, Specification for the Extensible Configuration Checklist Description Format (XCCDF) (NISTIR 7188), is available at http://csrc.nist.gov/checklists/
•Date:
27th January 2005 • Region: N.America/World •Type:
Article •Topic:
ISM |
