NIST SP800-117.pdf

preview
试读
26页
NIST
SP800
需积分: 0 1 下载量 42 浏览量 更新于2020-02-25 收藏 396KB PDF 举报
The purpose of this document is to provide an overview of the Security Content Automation Protocol (SCAP) Version 1.0. This document discusses SCAP at a conceptual level, focusing on how organizations can use SCAP-enabled tools to enhance their security posture. It also explains to IT product and service vendors how they can adopt SCAP Version 1.0 capabilities within their offerings. As new versions of SCAP are released, this document will be updated as needed to reflect any resulting differences in SCAP use and adoption. Configuration management technologies for non-security purposes, such as functionality and performance, are out of the scope of this document, but not necessarily out of scope for SCAP applicability. This document only addresses security for operational environments for deployed software and does not attempt to address problems with the secure development of software.
Guide to Adopting and Using the
Security Content Automation
Protocol (SCAP) Version 1.0
Recommendations of the National Institute of
Standards and Technology
Stephen Quinn
Karen Scarfone
Matthew Barrett
Chris Johnson
Special Publication 800-117
NIST Special Publication 800-117
Guide to Adopting and Using the Security
Content Automation Protocol (SCAP)
Version 1.0
Recommendations of the National
Institute of Standards and Technology
Stephen Quinn
Karen Scarfone
Matthew Barrett
Chris Johnson
Daniel Owens
C O M P U T E R S E C U R I T Y
Computer Security Division
Information Technology Laboratory
National Institute of Standards and Technology
Gaithersburg, MD 20899-8930
July 2010
U.S. Department of Commerce
Gary Locke, Secretary
National Institute of Standards and Technology
Dr. Patrick D. Gallagher, Director
Reports on Computer Systems Technology
The Information Technology Laboratory (ITL) at the National Institute of Standards and Technology
(NIST) promotes the U.S. economy and public welfare by providing technical leadership for the nation’s
measurement and standards infrastructure. ITL develops tests, test methods, reference data, proof of
concept implementations, and technical analysis to advance the development and productive use of
information technology. ITL’s responsibilities include the development of technical, physical,
administrative, and management standards and guidelines for the cost-effective security and privacy of
sensitive unclassified information in Federal computer systems. This Special Publication 800-series
reports on ITL’s research, guidance, and outreach efforts in computer security and its collaborative
activities with industry, government, and academic organizations.
Certain commercial entities, equipment, or materials may be identified in this
document in order to describe an experimental procedure or concept adequately.
Such identification is not intended to imply recommendation or endorsement by the
National Institute of Standards and Technology, nor is it intended to imply that the
entities, materials, or equipment are necessarily the best available for the purpose.
National Institute of Standards and Technology Special Publication 800-117
Natl. Inst. Stand. Technol. Spec. Publ. 800-117, 26 pages (Jul. 2010)
GUIDE TO ADOPTING AND USING THE SECURITY CONTENT AUTOMATION PROTOCOL (SCAP) VERSION 1.0
ii
Acknowledgments
The authors, Stephen Quinn, Karen Scarfone, and Chris Johnson of the National Institute of Standards
and Technology (NIST), and Matthew Barrett of G2 wish to thank their colleagues who reviewed drafts
of this document and contributed to its technical content. The authors would like to acknowledge Tim
Grance of NIST; Kimberly Watson, Lieutenant Colonel Joe Wolfkiel, Paul Bartock, and Dan Schmidt of
Department of Defense; Kevin Sitto, Brad Wood, and Greg Witte of G2; Scott Armstrong of Symantec;
Andy Bove of Secure Elements; and Rob Hollis of ThreatGuard for their keen and insightful assistance
throughout the development of the document.
Trademark Information
CVE, CCE, and OVAL are trademarks of The MITRE Corporation.
All other names are registered trademarks or trademarks of their respective companies.

剩余25页未读，继续阅读

资源推荐
资源评论
艾米的爸爸
  • 粉丝: 798
  • 资源: 314
上传资源 快速赚钱
voice
center-task 前往需求广场，查看用户热搜

最新资源