NIST, NSA create security language

XCCDF Site

Related Links

One of the best ways to strengthen IT security is to make sure all of the systems in an infrastructure conform to a set of security specifications. But that is often difficult and time-consuming.

To simplify the process, officials at the National Institute of Standards and Technology and the National Security Agency have developed a common specification language, dubbed Extensible Configuration Checklist Description Format, that can be used to write security checklists and related documents.

People in different environments might configure systems differently, said John Wack, a computer scientist in NIST's Computer Security Division, and the tools that help with security conformance are usually specific to a particular manufacturer's products.

"One area in which [the new language] could be particularly useful is in those situations where large configuration packages are needed, where you have a large network of disparate systems such as Windows PCs, Unix products and so on," Wack said.

Most security guidance documents are written as text in word processing documents or Web pages, said Neal Ziring, technical director of NSA's System and Network Attack Center.

The new language "is designed to be machine-readable and to serve for document generation, tailoring of checklists to local conditions and automated scoring of checklist compliance," he said.

In addition to fostering more uniform use of security guidelines, the language should also promote faster sharing of information among security professionals, vendors and system auditors, Ziring said. It should also improve automation of security testing and monitoring.

Now, developers need to configure their products to work with the format in a high-level manner so users can take advantage of the common approach promoted by the new language, Wack said.

About the Author

Brian Robinson is a freelance writer based in Portland, Ore.

Featured

  • Government Innovation Awards
    Government Innovation Awards - https://governmentinnovationawards.com

    Congratulations to the 2020 Rising Stars

    These early-career leaders already are having an outsized impact on government IT.

  • Cybersecurity
    cybersecurity (Rawpixel/Shutterstock.com)

    CMMC clears key regulatory hurdle

    The White House approved an interim rule to mandate defense contractors prove they adhere to existing cybersecurity standards from the National Institute of Standards and Technology.

Stay Connected