Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Risk

1/29/2008
03:49 PM
George V. Hulme
George V. Hulme
Commentary
50%
50%

Are You SCAP Ready?

In case you missed it, about a year ago the Office of Management and Budget issued policy memorandum M-07-11, aka the Implementation of Commonly Accepted Security Configurations for Windows Operating Systems. Essentially, this mandates that all federal agency systems must adhere to the Federal Desktop Core Configuration (FDCC) by February 2008. That's this Friday.

In case you missed it, about a year ago the Office of Management and Budget issued policy memorandum M-07-11, aka the Implementation of Commonly Accepted Security Configurations for Windows Operating Systems. Essentially, this mandates that all federal agency systems must adhere to the Federal Desktop Core Configuration (FDCC) by February 2008. That's this Friday.The goal is laudable; as these security configurations can go a long way to help CIOs and federal agency CISOs keep systems safer. But both the configuration and verification of this standard system implementation rely heavily on a rather obscure protocol known as SCAP, which is the Security Content Automation Protocol.

SCAP, basically, is a checklist that relies on a handful of open standards for naming software flaw conventions and configurations in applications and systems. So, if your scanner is SCAP compliant, you can more swiftly check to see if your agency systems are FDCC compliant.

That's probably why, in another memo, the OMB mandated that federal CIOs must use SCAP-validated tools for FDCC software acceptance for all U.S. government systems.

And that's where trouble starts to enter this acronym paradise. This Friday, those federal agencies are supposed to submit to OMB a listing of all of their systems running XP and Vista, as well as how many are FDCC compliant (Though SCAP is not required for this deadline).

Here's the rub: as of today, no SCAP products have been validated. There's just this Web page listing no validated SCAP tools. However, the National Institute of Standards and Technology has promised a list by this Friday.

There's nothing like pushing a deadline.

In the long run, SCAP will no doubt will make it easier for agencies, vendors, and auditors to maintain more secure federal systems. A secure configuration that can be easily validated means fewer mistakes and easier enforcement of sound security practices.

For those agencies that don't want to wait until Friday to get started, here's a list of scanners that purport to have SCAP capabilities.

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Current Issue
6 Emerging Cyber Threats That Enterprises Face in 2020
This Tech Digest gives an in-depth look at six emerging cyber threats that enterprises could face in 2020. Download your copy today!
Flash Poll
State of Cybersecurity Incident Response
State of Cybersecurity Incident Response
Data breaches and regulations have forced organizations to pay closer attention to the security incident response function. However, security leaders may be overestimating their ability to detect and respond to security incidents. Read this report to find out more.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2020-11107
PUBLISHED: 2020-04-02
An issue was discovered in XAMPP before 7.2.29, 7.3.x before 7.3.16 , and 7.4.x before 7.4.4 on Windows. An unprivileged user can change a .exe configuration in xampp-contol.ini for all users (including admins) to enable arbitrary command execution.
CVE-2020-11444
PUBLISHED: 2020-04-02
Sonatype Nexus Repository Manager 3.x up to and including 3.21.2 has Incorrect Access Control.
CVE-2020-7617
PUBLISHED: 2020-04-02
ini-parser through 0.0.2 is vulnerable to Prototype Pollution.The library could be tricked into adding or modifying properties of Object.prototype using a '__proto__' payload.
CVE-2020-8835
PUBLISHED: 2020-04-02
In the Linux kernel 5.5.0 and newer, the bpf verifier (kernel/bpf/verifier.c) did not properly restrict the register bounds for 32-bit operations, leading to out-of-bounds reads and writes in kernel memory. The vulnerability also affects the Linux 5.4 stable series, starting with v5.4.7, as the intr...
CVE-2020-8423
PUBLISHED: 2020-04-02
A buffer overflow in the httpd daemon on TP-Link TL-WR841N V10 (firmware version 3.16.9) devices allows an authenticated remote attacker to execute arbitrary code via a GET request to the page for the configuration of the Wi-Fi network.