Tenable and SCAP 1.1
Tenable recently announced that SecurityCenter 4 has been validated by NIST as conforming to the Security Content Automation Protocol (SCAP) version 1.0. The specifications for the latest version of SCAP, 1.1, have recently been released through NIST’s third public draft of Special Publication 800-126 Rev. 1, and the revision is currently open until January 28 for public comment on implementation, content or functional issues within the specification. Tenable is already focusing on the changes included in SCAP 1.1 and will incorporate them into both SecurityCenter and Tenable’s xTool, which is used to parse XCCDF SCAP content available from NIST and also convert SecurityCenter reports into the FDCC reporting format.
SCAP 1.1 plans to add the Open Checklist Interactive Language (OCIL) to the specification, as well as support the upgrade of the Open Vulnerability and Assessment Language (OVAL) to version 5.8. Other components of SCAP include the eXtensible Configuration Checklist Description Format (XCCDF), Common Vulnerabilities and Exposures (CVE), Common Vulnerability Scoring System (CVSS), Common Platform Enumeration (CPE) and Common Configuration Enumeration (CCE). CVE IDs and CVSS scores are included in Nessus and PVS plugins, which allows for easier identification and risk assessment of vulnerabilities found during monitoring and compliance efforts.
As a finalized version of SCAP 1.1 approaches, government agencies and businesses in the private sector are looking to solidify their security posture and compliance with numerous standards (such as FDCC and USGCB for federal systems, and PCI DSS and HITRUST for the financial and medical sectors, respectively). According to SP 800-126, “SCAP is achieving widespread adoption by major software and hardware manufacturers and has become a significant component of large information security management and governance programs”. More information about how SecurityCenter 4 and the xTool can assist with these goals can be found on NIST’s product validation page for Tenable or by contacting Tenable’s sales team.
Related Articles
Cybersecurity Snapshot: Schools Suffer Heavy Downtime Losses Due To Ransomware, as Banks Grapple with AI Challenges
August 30, 2024The cost of ransomware downtime in schools gets pegged at $500K-plus per day. Meanwhile, check out the AI-usage risks threatening banks’ cyber resilience. Plus, Uncle Sam is warning about a dangerous Iran-backed hacking group. And get the latest on AI-system inventories, the APT29 nation-state attacker and digital identity security!
AA24-241A : Joint Cybersecurity Advisory on Iran-based Cyber Actors Targeting US Organizations
August 28, 2024A joint Cybersecurity Advisory highlights Iran-based cyber actor ransomware activity targeting U.S. organizations. The advisory includes CVEs exploited, alongside techniques, tactics and procedures used by the threat actors.
The Data-Factor: Why Integrating DSPM Is Key to Your CNAPP Strategy
August 28, 2024DSPM solutions provide a comprehensive, up-to-date view into cloud-based data and risk. An integrated CNAPP and DSPM solution elevates this analysis to expose toxic combinations and security gaps across cloud environments.