NIST, NSA create security language


Related Links

One of the best ways to strengthen IT security is to make sure all of the systems in an infrastructure conform to a set of security specifications. But that is often difficult and time-consuming.

To simplify the process, officials at the National Institute of Standards and Technology and the National Security Agency have developed a common specification language, dubbed Extensible Configuration Checklist Description Format, that can be used to write security checklists and related documents.

People in different environments might configure systems differently, said John Wack, a computer scientist in NIST's Computer Security Division, and the tools that help with security conformance are usually specific to a particular manufacturer's products.

"One area in which [the new language] could be particularly useful is in those situations where large configuration packages are needed, where you have a large network of disparate systems such as Windows PCs, Unix products and so on," Wack said.

Most security guidance documents are written as text in word processing documents or Web pages, said Neal Ziring, technical director of NSA's System and Network Attack Center.

The new language "is designed to be machine-readable and to serve for document generation, tailoring of checklists to local conditions and automated scoring of checklist compliance," he said.

In addition to fostering more uniform use of security guidelines, the language should also promote faster sharing of information among security professionals, vendors and system auditors, Ziring said. It should also improve automation of security testing and monitoring.

Now, developers need to configure their products to work with the format in a high-level manner so users can take advantage of the common approach promoted by the new language, Wack said.

About the Author

Brian Robinson is a freelance writer based in Portland, Ore.


  • Workforce
    Shutterstock image 1658927440 By Deliris masks in office coronavirus covid19

    White House orders federal contractors vaccinated by Dec. 8

    New COVID-19 guidance directs federal contractors and subcontractors to make sure their employees are vaccinated — the latest in a series of new vaccine requirements the White House has been rolling out in recent weeks.

  • FCW Perspectives
    remote workers (elenabsl/

    Post-pandemic IT leadership

    The rush to maximum telework did more than showcase the importance of IT -- it also forced them to rethink their own operations.

Stay Connected