Cover Pages Logo SEARCH
Advanced Search
ABOUT
Site Map
CP RSS Channel
Contact Us
Sponsoring CP
About Our Sponsors

NEWS
Cover Stories
Articles & Papers
Press Releases

CORE STANDARDS
XML
SGML
Schemas
XSL/XSLT/XPath
XLink
XML Query
CSS
SVG

TECHNOLOGY REPORTS
XML Applications
General Apps
Government Apps
Academic Apps

EVENTS
LIBRARY
Introductions
FAQs
Bibliography
Technology and Society
Semantics
Tech Topics
Software
Related Standards
Historic

NIST and NSA XML-based Language Formats Checklists for IT Security


National Institute of Standards and Technology (NIST) XML-based Language Formats Checklists for IT Security


Gaithersburg and Fort Meade, MD, USA. January 26, 2005.

To make it easier to measure the security of an information technology product or system, researchers at the National Institute of Standards and Technology (NIST) and the National Security Agency (NSA) have developed a common specification language — Extensible Configuration Checklist Description Format (XCCDF) — for writing security checklists and related documents.

Increasingly, computers and other information technology products are vulnerable to multiple threats including viruses, worms and identity or information theft. One basic, yet effective, security tool is the security configuration checklist — a series of instructions for configuring an information technology (IT) product to a baseline or benchmark level of security. Configuring a system into conformance with a benchmark or other security specification is a time-consuming and very technical task. Automated tools are available to help system administrators determine a system's conformance and recommend corrective measures. However, most of these tools are designed for a particular IT product or system.

XCCDF is an XML-based format that is flexible, vendor-neutral and suited for a wide variety of checklist applications including measuring conformance of an IT system to security benchmarks and generating a record of a benchmark test. XML is a language — analogous to the HTML codes used to format web pages — that describes information in a standard way to allow computers to exchange information and act on it.

"XCCDF's common format will help security professionals, vendors and system auditors to more quickly exchange information and improve automation of security testing and configuration checking," said John Wack, a researcher in NIST's Computer Security Division.

The XCCDF specification document, Specification for the Extensible Configuration Checklist Description Format (XCCDF) (NISTIR 7188), is available at http://csrc.nist.gov/checklists/. NIST, in conjunction with the Department of Homeland Security, NSA, and other organizations, is developing computer security checklists for many IT products widely used by government agencies.

Contact

Jan Kosko
Email: janice.kosko@nist.gov
WWW: http://www.nist.gov/
Tel: +1 301-975-2767

[Source: http://www.nist.gov/public_affairs/techbeat/tb2005_0126.htm#XML]


Prepared by Robin Cover for The XML Cover Pages archive. See details in the news story "NIST and NSA Release XML-Based XCCDF Specification for Security Checklists."


Globe Image

Document URL: http://xml.coverpages.org/NIST-NSA-XCCDF.html  —  Legal stuff