NIST and NSA XML-based Language Formats Checklists for IT Security

National Institute of Standards and Technology (NIST) XML-based Language Formats Checklists for IT Security

Gaithersburg and Fort Meade, MD, USA. January 26, 2005.

To make it easier to measure the security of an information technology product or system, researchers at the National Institute of Standards and Technology (NIST) and the National Security Agency (NSA) have developed a common specification language — Extensible Configuration Checklist Description Format (XCCDF) — for writing security checklists and related documents.

Increasingly, computers and other information technology products are vulnerable to multiple threats including viruses, worms and identity or information theft. One basic, yet effective, security tool is the security configuration checklist — a series of instructions for configuring an information technology (IT) product to a baseline or benchmark level of security. Configuring a system into conformance with a benchmark or other security specification is a time-consuming and very technical task. Automated tools are available to help system administrators determine a system's conformance and recommend corrective measures. However, most of these tools are designed for a particular IT product or system.

XCCDF is an XML-based format that is flexible, vendor-neutral and suited for a wide variety of checklist applications including measuring conformance of an IT system to security benchmarks and generating a record of a benchmark test. XML is a language — analogous to the HTML codes used to format web pages — that describes information in a standard way to allow computers to exchange information and act on it.

"XCCDF's common format will help security professionals, vendors and system auditors to more quickly exchange information and improve automation of security testing and configuration checking," said John Wack, a researcher in NIST's Computer Security Division.

The XCCDF specification document, Specification for the Extensible Configuration Checklist Description Format (XCCDF) (NISTIR 7188), is available at http://csrc.nist.gov/checklists/. NIST, in conjunction with the Department of Homeland Security, NSA, and other organizations, is developing computer security checklists for many IT products widely used by government agencies.

Contact

Jan Kosko
Email: janice.kosko@nist.gov
WWW: http://www.nist.gov/
Tel: +1 301-975-2767

[Source: http://www.nist.gov/public_affairs/techbeat/tb2005_0126.htm#XML]

Prepared by Robin Cover for The XML Cover Pages archive. See details in the news story "NIST and NSA Release XML-Based XCCDF Specification for Security Checklists."

SEARCH Advanced Search ABOUT Site Map CP RSS Channel Contact Us Sponsoring CP About Our Sponsors NEWS Cover Stories Articles & Papers Press Releases CORE STANDARDS XML SGML Schemas XSL/XSLT/XPath XLink XML Query CSS SVG TECHNOLOGY REPORTS XML Applications General Apps Government Apps Academic Apps EVENTS LIBRARY Introductions FAQs Bibliography Technology and Society Semantics Tech Topics Software Related Standards Historic	NIST and NSA XML-based Language Formats Checklists for IT Security National Institute of Standards and Technology (NIST) XML-based Language Formats Checklists for IT Security Gaithersburg and Fort Meade, MD, USA. January 26, 2005. To make it easier to measure the security of an information technology product or system, researchers at the National Institute of Standards and Technology (NIST) and the National Security Agency (NSA) have developed a common specification language — Extensible Configuration Checklist Description Format (XCCDF) — for writing security checklists and related documents. Increasingly, computers and other information technology products are vulnerable to multiple threats including viruses, worms and identity or information theft. One basic, yet effective, security tool is the security configuration checklist — a series of instructions for configuring an information technology (IT) product to a baseline or benchmark level of security. Configuring a system into conformance with a benchmark or other security specification is a time-consuming and very technical task. Automated tools are available to help system administrators determine a system's conformance and recommend corrective measures. However, most of these tools are designed for a particular IT product or system. XCCDF is an XML-based format that is flexible, vendor-neutral and suited for a wide variety of checklist applications including measuring conformance of an IT system to security benchmarks and generating a record of a benchmark test. XML is a language — analogous to the HTML codes used to format web pages — that describes information in a standard way to allow computers to exchange information and act on it. "XCCDF's common format will help security professionals, vendors and system auditors to more quickly exchange information and improve automation of security testing and configuration checking," said John Wack, a researcher in NIST's Computer Security Division. The XCCDF specification document, Specification for the Extensible Configuration Checklist Description Format (XCCDF) (NISTIR 7188), is available at http://csrc.nist.gov/checklists/. NIST, in conjunction with the Department of Homeland Security, NSA, and other organizations, is developing computer security checklists for many IT products widely used by government agencies. Contact Jan Kosko Email: janice.kosko@nist.gov WWW: http://www.nist.gov/ Tel: +1 301-975-2767 [Source: http://www.nist.gov/public_affairs/techbeat/tb2005_0126.htm#XML] Prepared by Robin Cover for The XML Cover Pages archive. See details in the news story "NIST and NSA Release XML-Based XCCDF Specification for Security Checklists."