Security Automation - IAC - Defense Technical Information Center

include references to CVEs. By employing
these SCAP standards, assets, events,
and vulnerabilities can be quickly related
to determine if configuration
management modifications in the form
of Information Assurance Vulnerability
Alerts (IAVA) are needed.
To realize this use case, the pilot
identified authoritative data sources for
vulnerabilities, assets, and events and
then instrumented them with Web
service interfaces to expose their data in
accordance with CND data exchange
standards. NIST’s National Vulnerability
Database (NVD) provides vulnerability
data. The Army’s Asset and Vulnerability
Tracking Resource (A&VTR) provides
asset and configuration data. The Navy’s
Prometheus repository provides event
data. Data from each of the sources is
consumed and correlated within a
lightweight Web-based CND workspace
to provide authorized users visibility
into the relationships between
vulnerability, asset, and event data. The
pilot correlates data from a variety of
data sources and provides tailored views
without manipulating the original data
and without replicating the diverse data
sets into a centralized repository.
Authorized users can view a
summary of newly identified
vulnerabilities over time, browse
vulnerability summaries, view
vulnerability details, identify the assets
that are potentially vulnerable, and
determine the criticality of events that
are occurring due to the vulnerability
(Figure 3). Authorized users can
determine the distribution of assets
across geographical regions and Mission
Assurance Category (MAC) levels, view
the details of any given asset, and identify
all of the vulnerabilities to which the
asset may be vulnerable (Figure 4).
Authorized users can also see a summary
of event counts over time, identify the top
occurring events, determine the severity
of events, and review the details of the
vulnerabilities that are related to the
event signatures (Figure 5). These
activities, which used to take days or
months to complete, can now be
Figure 3 Event and Vulnerability Trends.
accomplished within a matter of minutes
with a series of mouse clicks.
The CND Data Strategy Pilot is
bringing confidence and validity to the
SCAP data standards, Web Service
specifications, and the supporting
architecture developed to realize the
objectives of security measurement and
automation. Powered by machine-tomachine
communications, this
net-centric CND environment
demonstrates the ability for standards to
automate and accelerate the process of
correlating events and vulnerabilities to
assets within DoD networks. The effort
demonstrates the capability to integrate
data from several diverse data sources
distributed across the GIG and is an
example of the type of powerful
composite applications that can quickly
be created given the availability of shared
information, common data specifications,
and contemporary Web service
technologies. Efforts are ongoing to add
more data sources and validate additional
standards related to remediation, systems,
missions, and operations as the CND
Data Strategy Pilot matures and more
components join in the effort.
Based on the successes of the data
strategy and piloting efforts, there are a
number of operational deployment
activities focused on establishing the
foundation of an integrated set of
interoperable CND systems—
ff
ff
The Host Based Security System
(HBSS) baseline has been expanded
to include an asset Web service that
publishes asset data to the
enterprise in accordance with CND
data standards. This Web service
will help CND analysts obtain a
greater degree of situational
awareness of what is happening
with the DoD enterprise networks
at the asset level. The service will
enable an enterprise catalog of
assets on DoD networks.
The Information Assurance
Vulnerability Management (IAVM)
system is being enhanced based on
the successes of the CND data
strategy pilot. Vulnerability
assessment teams will use this
enhanced knowledge of how
vulnerabilities, assets, and events
relate to make informed decisions
about the creation of configuration
management policies. Leveraging
SCAP data standards, such as Open
Vulnerability and Assessment
Language (OVAL) and eXtensible
Configuration Checklist Description
Format (XCCDF), this IAVM system
will enable creation and
dissemination of machine-readable
26 IAnewsletter Vol 13 No 1 Winter 2010 • http://iac.dtic.mil/iatac