Two new documents of SCAP help improve your computer's security management automating

ScienceDaily (16 March 2011) increasingly difficult to keep track of all vulnerabilities present complex in today's operating systems and applications. Attackers look for all the time, to exploit these vulnerabilities to take the identity fraud, plagiarism and other. National Institute of standards and technology (NIST) has released two publications updated to help organizations find and manage vulnerabilities more effectively, by standardizing the vulnerabilities identified, prioritized, and they are reported.

The security departments of computer work behind the scenes in all government ministries and other organizations to secure computers and networks. Valuable tools for software security automation is that of the NIST security content automation protocol (SCAP). SCAP-based software can be used to automatically check for individual computers to see if they have any known vulnerabilities, and if they have the appropriate security settings instead of corrections. Security issues can be identified quickly and accurately, allowing them to resolve before hackers can exploit them.

The first publication, the technical specification for the security content automation protocol (SCAP) version 1.1 (NIST Special publication (SP) 800-126 last 1) refines the requirements of the Protocol SCAP version 1.0. SCAP is a suite of specifications for standardizing the format and terminology that relate to security software to evaluate software flaws, security and software configurations.

SP 800-126 Rev. 1 tightens the requirements and specifications of individual suite to support the functionality of the SCAP and ensure interoperability between SCAP tools. It also adds a new specification-open checklist interactive language (OCIL)-which allows security professionals to collect information that is not accessible by means of automatic. For example, you can use OCIL ask users about security awareness training, or prompts the administrator to review security settings is available only through a proprietary graphical user interface. In addition, SCAP 1.1 reader for version 8.0 of the open vulnerability and assessment language (Oval).

NIST and others provide a publicly accessible stores of information security and standard security configurations, you can download templates SCAP and used by the Protocol SCAP compatible tools. For example, NIST national vulnerability database (NVD) provides a unique identifier for each vulnerability reported software, analysis of potential damage, specifies risk. NVD grew in 2002 about 6,000 drawings 46,000 in early 2011. It is updated daily.

The second document, a guide to using the vulnerability naming scheme (Special Edition publication 800-53-1), provides recommendations for naming schemes used by SCAP. Before these were standard, various organizations vulnerabilities in different ways, which created confusion. These naming schemes "may be a better synthesis of information about vulnerabilities in software," explained co-author David Waltermire, minimizes confusion and can lead to faster security patches. Common vulnerabilities and exposures (CVE) identification of defects in the software; A common configuration enumeration (CCE) is the configuration problems.

SP 800-68 Rev. 1 provides an introduction to the two naming schemes, recommends their use. It also offers some of the providers of software and services you need to use the names of the vulnerability and naming their products, service offerings.

These new publications can be downloaded from NIST. Technical specification for the security content automation protocol (SCAP) version 1.1 (NIST Special Publication 800-126 last 1) can be found on http://csrc.nist.gov/publications/nistpubs/800-126-rev1/SP800-126r1.pdf. You can find the vulnerability naming scheme (Special Edition publication 800-53-1) in http://csrc.nist.gov/publications/nistpubs/800-51-rev1/SP800-51rev1.pdf.

Email or share this story:

---

The source of the story:

The above story printed (with writers adaptations by a teamdaily science) from materials that can be by the National Institute of standards technology (NIST).

---

Note: If no source is cited, instead.

Disclaimer: hdioth in this article do not necessarily reflect those of his team or ScienceDaily.

A new publication from the Federal information security risk management

ScienceDaily (2 March 2011) , the National Institute of standards and technology (NIST) published the final version of special publication that can help organizations to more effectively integrate information security planning and goals of their mission-critical functions.

Enterprise: security information management, mission, and system information (NIST Special Publication 800-39) provides the basics of a three-tiered, risk-management approach changes fundamentally how we manage information security risk to the federal level, "says Ron Ross, a NIST and the main authors of the publication.

For decades, organizations have to manage risk at the level of the information system, which resulted in a very narrow perspective that constrain risk-based decisions by senior management, explains Ross. SP 800-39 calls for a holistic approach to determine what senior leaders need to be protected is based on the core tasks of the Organization, and business functions. For example, administrators of power distribution network is related to the need to ensure the security of your computer keeps hackers interfering with the plant's power generation or to get into the power grid to bring disaster.

The publication is the fourth in a series of risks and manage information security guidelines developed by the joint task force transformation initiative, a joint partnership between the Department of Defense, intelligence community, Committee on national security systems, NIST.

A risk management approach to the multi-tiered described SP 800-39 organization progress for information systems. The goal is to ensure that the strategic considerations and decisions with respect to drive investment in operational risk management organizational operations (including mission, functions, image, and reputation), organizational assets, individuals, other organizations (collaborative or partnering with federal agencies and contractors), the nation.

This type of risk-based decisions, is critical as organizations advanced persistent threats of sophisticated cyber attacks that may harm or weakened the support information systems in the Federal Government's critical applications.

"SP 800-39 is engaged in building a more secure information systems ultimately will allow senior leaders, and administrators better understand the mission, the risk to their business brought by organizations to increasingly use information technology and connectivity, dependency ???"???? Ross.

SP 800-39, security information management: Organization, mission and display of information system, developed in support of federal information security management Act (FISMA). Can be downloaded from http://csrc.nist.gov/publications/nistpubs/800-39/SP800-39-final.pdf.

Email or share this story:

---

The source of the story:

The above story printed (with writers adaptations by a teamdaily science) from materials that can be by the National Institute of standards technology (NIST).

---

Note: If no source is cited, instead.

Disclaimer: hdioth in this article do not necessarily reflect those of his team or ScienceDaily.

CeBIT 2011: cloud computing management

ScienceDaily (February 11, 2011) up field of cloud computing is an interesting one, and then, not only for businesses. The field of public administration from the technology. Fraunhofer institutes are developing solutions to create such systems, and to effectively implement the concepts of security.

Researchers to be at these other solutions in computing "cloud" in CeBIT Hanover from 1-5 March 2011.

Cloud computing is the evolution is tempting for IT administrators: with cloud computing, companies and organizations no longer need to purchase a server and software solutions themselves and instead capacities they need data, computing power and professional providers. You pay only for the purpose. In Germany, especially companies are turning cloud computing, data transfer, applications and networks their farm in the Amazon, Google, IBM, Microsoft or other it service providers. In the space of a few years, cloud computing, appeared as a market worth billions of, with a high level of importance for the German economy business location policy.

In the autumn 2010, researchers Fraunhofer Institute FOKUS open communication system in Berlin, together with the release of the Hertie School of governance, publish research, "eGovernment Kooperatives-cloud computing ldncig Die Öffentliche Verwaltung" ["eGovernment: cloud computing for the cooperative Administration: public"]. The research was already inviting ISPRAT, an organization dedicated to the interdisciplinary studies politics, law, management, and technology. The research addresses the security aspects, identify risks and uses different scenarios of application in order to describe the benefits of this new technology and for public administrators, with a particular focus on federal requirements in Germany.

"A lot of reservations about cloud computing in the public administration. First, because of the need to protect the basic personal data of citizens responsible for public administrators; But also the potential of outsourcing frightened by the authorities. Thanks for fear of loss of expertise, and another one because the law requires a kernel tasks remain in the hands of administrators. "this is how to learn maiozmim strick Linda of FOKUS sums is seated.

Research points to security risks specific to the cloud actually exist, but that these can be completely understand, analyze. "There is reason to even put a cloud-based security standards can actually fill out than the classic solutions," explains strick. To help administrators with the introduction of new technology, FOKUS eGovernment laboratory researchers are developing an application to use scenarios of media-split-free and hence interoperable cloud computing technologies.

Cockpit for security

Public authorities to allow companies to acquire hands-on experience with new technology and test the security concepts, experts from the Fraunhofer Institute for secure information technology sit in Munich have created a cloud computing test lab. Along with the security concepts and technologies for cloud computing providers, researchers are also developing and learn strategies for integrating a secure IT infrastructure and cloud services.

"Our test lab, a function, reliability and interoperability, along with individual security, penetration testing analyses can be made, each is considered a developmental steps in administration of individual services, fathers-a comprehensive systems testing teams up a fully functional," notes Angelika Ruppel of SIT in Munich.

Working with the German Federal office for information security [ldncig Bundesamt Sicherheit der Informationstechnik] BSI, her Division has drafted minimum requirements for providers of cloud and cockpit. With this solution, companies to securely transfer data between different systems within cloud monitoring information relevant to security and data protection. Even the application of the hybrid cloud infrastructure, which companies use internal and external computing power, you can securely control through the cockpit of the cloud.

Email or share this story:

---

Story source:

The story above printed (with adapting to editing by a team of the day-to-day science) materials provided by the Fraunhofer Institute Gesellschaft, via AlphaGalileo.

---

Note: you mentioned if not counting, the source is when instead.

Disclaimer: opinions in this article do not necessarily reflect those of its employees or ScienceDaily.