際際滷

際際滷Share a Scribd company logo
Datastream
http://martin.preisler.me/category/scap/page/2
Datastream can be thought of as an archive of interlinked SCAP
content(XCCDF,OVAL,CPE,)
Type of datastream
 Source datastream (SDS)
 Result datastream (ARF)
>> The scanner takes a SDS, evaluates and gives results in the ARF
format back.
Source Datastream
 Has a root element called data-stream-collection.
 data-stream-collection contains 1 or more elements called data-
stream.
>>> each SDS has 1 or more modes in which it can be evaluated.
National Checklist Program (NCP)
 See NIST Special Publication 800-70 Rev.2
 Frequently Asked Questions: General Information
>> http://web.nvd.nist.gov/view/ncp/information
Security Configuration Checklist
 Also called lockdown, hardening guide, benchmark, security technical
implementation guide (STIG).
 Series of instruction for configuring a product to particular
operational environment.
 Can comprise templates, automated scripts, patches or patch
descriptions, XML files, and other procedures.
NIST maintains the National Checklist
Repository.
http://checklists.nist.gov/
Selecting checklists?
 Checklist users should carefully consider the degree of automation
and the source of each checklist.
 NIST defined 4 tiers of checklists to assist users.
 Tier1 checklists: are prose-based with narrative descriptions of how a
person can manually alter a products configuration.
 Tier4 checklists: have all security settings documented in machine-
readable, standardized Security Content Automation Protocol (SCAP)
formats,.. (see SP 800-70 Rev2).
Concept scap

More Related Content

Viewers also liked (20)

Brand Focus 1 Page Presentation
Brand Focus 1 Page PresentationBrand Focus 1 Page Presentation
Brand Focus 1 Page Presentation
Ice Mom
Cs presentation
Cs presentationCs presentation
Cs presentation
tamourk2
Faheem_Resume_068315
Faheem_Resume_068315Faheem_Resume_068315
Faheem_Resume_068315
Faheem Ahmad
Varuna khullar founder@yogawith v
Varuna khullar   founder@yogawith vVaruna khullar   founder@yogawith v
Varuna khullar founder@yogawith v
Varuna Khullar
Varuna khullar Founder@yogawith v
Varuna khullar   Founder@yogawith vVaruna khullar   Founder@yogawith v
Varuna khullar Founder@yogawith v
Varuna Khullar
Especificaciones  de_techo_de_acceso_1403709000421Especificaciones  de_techo_de_acceso_1403709000421
Especificaciones de_techo_de_acceso_1403709000421
culon88
McHardy Financial Nov -Dec 2015 Newsletter
McHardy Financial Nov -Dec 2015 NewsletterMcHardy Financial Nov -Dec 2015 Newsletter
McHardy Financial Nov -Dec 2015 Newsletter
Pam Cradock Dip PFS
Photoshop Exercises
Photoshop Exercises Photoshop Exercises
Photoshop Exercises
diannemarie420
Wicked Problems: Global Warming and Crustaceans
Wicked Problems: Global Warming and Crustaceans Wicked Problems: Global Warming and Crustaceans
Wicked Problems: Global Warming and Crustaceans
diannemarie420
Evaluation Question 4
Evaluation Question 4Evaluation Question 4
Evaluation Question 4
jcraske7nre
REPORT_UML_PRITAM
REPORT_UML_PRITAMREPORT_UML_PRITAM
REPORT_UML_PRITAM
Pritam Roy
eWIN_Case_Study_-_A_Workforce_Strategy_to_Improve_Staff_Engagement[1]
eWIN_Case_Study_-_A_Workforce_Strategy_to_Improve_Staff_Engagement[1]eWIN_Case_Study_-_A_Workforce_Strategy_to_Improve_Staff_Engagement[1]
eWIN_Case_Study_-_A_Workforce_Strategy_to_Improve_Staff_Engagement[1]
Sue Whittam
Aimee Gonthier From BFA 2012 to MFA 2015
Aimee Gonthier From BFA 2012 to MFA 2015Aimee Gonthier From BFA 2012 to MFA 2015
Aimee Gonthier From BFA 2012 to MFA 2015
Aimee Gonthier
Tecnologia informaticaTecnologia informatica
Tecnologia informatica
taniavanessita
Qu辿 es un buscadorQu辿 es un buscador
Qu辿 es un buscador
agusmuras22
Leading From Your Strengths
Leading From Your StrengthsLeading From Your Strengths
Leading From Your Strengths
Chad Danner
The Intersection of Content Strategy and Instructional Design
The Intersection of Content Strategy and Instructional DesignThe Intersection of Content Strategy and Instructional Design
The Intersection of Content Strategy and Instructional Design
Ann Fandrey
Caderno tecnico 82 medicina de felinoCaderno tecnico 82 medicina de felino
Caderno tecnico 82 medicina de felino
argeropulos1
Science ppt
Science pptScience ppt
Science ppt
Kushagra Sharma
Brand Focus 1 Page Presentation
Brand Focus 1 Page PresentationBrand Focus 1 Page Presentation
Brand Focus 1 Page Presentation
Ice Mom
Cs presentation
Cs presentationCs presentation
Cs presentation
tamourk2
Faheem_Resume_068315
Faheem_Resume_068315Faheem_Resume_068315
Faheem_Resume_068315
Faheem Ahmad
Varuna khullar founder@yogawith v
Varuna khullar   founder@yogawith vVaruna khullar   founder@yogawith v
Varuna khullar founder@yogawith v
Varuna Khullar
Varuna khullar Founder@yogawith v
Varuna khullar   Founder@yogawith vVaruna khullar   Founder@yogawith v
Varuna khullar Founder@yogawith v
Varuna Khullar
Especificaciones  de_techo_de_acceso_1403709000421Especificaciones  de_techo_de_acceso_1403709000421
Especificaciones de_techo_de_acceso_1403709000421
culon88
McHardy Financial Nov -Dec 2015 Newsletter
McHardy Financial Nov -Dec 2015 NewsletterMcHardy Financial Nov -Dec 2015 Newsletter
McHardy Financial Nov -Dec 2015 Newsletter
Pam Cradock Dip PFS
Photoshop Exercises
Photoshop Exercises Photoshop Exercises
Photoshop Exercises
diannemarie420
Wicked Problems: Global Warming and Crustaceans
Wicked Problems: Global Warming and Crustaceans Wicked Problems: Global Warming and Crustaceans
Wicked Problems: Global Warming and Crustaceans
diannemarie420
Evaluation Question 4
Evaluation Question 4Evaluation Question 4
Evaluation Question 4
jcraske7nre
REPORT_UML_PRITAM
REPORT_UML_PRITAMREPORT_UML_PRITAM
REPORT_UML_PRITAM
Pritam Roy
eWIN_Case_Study_-_A_Workforce_Strategy_to_Improve_Staff_Engagement[1]
eWIN_Case_Study_-_A_Workforce_Strategy_to_Improve_Staff_Engagement[1]eWIN_Case_Study_-_A_Workforce_Strategy_to_Improve_Staff_Engagement[1]
eWIN_Case_Study_-_A_Workforce_Strategy_to_Improve_Staff_Engagement[1]
Sue Whittam
Aimee Gonthier From BFA 2012 to MFA 2015
Aimee Gonthier From BFA 2012 to MFA 2015Aimee Gonthier From BFA 2012 to MFA 2015
Aimee Gonthier From BFA 2012 to MFA 2015
Aimee Gonthier
Tecnologia informaticaTecnologia informatica
Tecnologia informatica
taniavanessita
Qu辿 es un buscadorQu辿 es un buscador
Qu辿 es un buscador
agusmuras22
Leading From Your Strengths
Leading From Your StrengthsLeading From Your Strengths
Leading From Your Strengths
Chad Danner
The Intersection of Content Strategy and Instructional Design
The Intersection of Content Strategy and Instructional DesignThe Intersection of Content Strategy and Instructional Design
The Intersection of Content Strategy and Instructional Design
Ann Fandrey
Caderno tecnico 82 medicina de felinoCaderno tecnico 82 medicina de felino
Caderno tecnico 82 medicina de felino
argeropulos1

Similar to Concept scap (20)

Security Automation Simplified via NIST OSCAL: Were Not in Kansas Anymore
Security Automation Simplified via NIST OSCAL: Were Not in Kansas AnymoreSecurity Automation Simplified via NIST OSCAL: Were Not in Kansas Anymore
Security Automation Simplified via NIST OSCAL: Were Not in Kansas Anymore
Priyanka Aash
2012-10-16 Mil-OSS Working Group: Introduction to SCAP Security Guide
2012-10-16 Mil-OSS Working Group: Introduction to SCAP Security Guide2012-10-16 Mil-OSS Working Group: Introduction to SCAP Security Guide
2012-10-16 Mil-OSS Working Group: Introduction to SCAP Security Guide
Shawn Wells
Analysis of Database Issues using AHF and Machine Learning v2 - SOUG
Analysis of Database Issues using AHF and Machine Learning v2 -  SOUGAnalysis of Database Issues using AHF and Machine Learning v2 -  SOUG
Analysis of Database Issues using AHF and Machine Learning v2 - SOUG
Sandesh Rao
Analysis of Database Issues using AHF and Machine Learning v2 - AOUG2022
Analysis of Database Issues using AHF and Machine Learning v2 -  AOUG2022Analysis of Database Issues using AHF and Machine Learning v2 -  AOUG2022
Analysis of Database Issues using AHF and Machine Learning v2 - AOUG2022
Sandesh Rao
Getting optimal performance from oracle e-business suite presentation
Getting optimal performance from oracle e-business suite presentationGetting optimal performance from oracle e-business suite presentation
Getting optimal performance from oracle e-business suite presentation
Berry Clemens
Security defined routing_cybergamut_v1_1
Security defined routing_cybergamut_v1_1Security defined routing_cybergamut_v1_1
Security defined routing_cybergamut_v1_1
Joel W. King
Cdcr apachecon-talk
Cdcr apachecon-talkCdcr apachecon-talk
Cdcr apachecon-talk
Amrit Sarkar
Dynamics ax performance tuning
Dynamics ax performance tuningDynamics ax performance tuning
Dynamics ax performance tuning
OutsourceAX
Whats Evolving in the Elastic Stack
Whats Evolving in the Elastic StackWhats Evolving in the Elastic Stack
Whats Evolving in the Elastic Stack
Elasticsearch
Spark and Couchbase: Augmenting the Operational Database with Spark
Spark and Couchbase: Augmenting the Operational Database with SparkSpark and Couchbase: Augmenting the Operational Database with Spark
Spark and Couchbase: Augmenting the Operational Database with Spark
Spark Summit
DBA 101 : Calling all New Database Administrators (PPT)
DBA 101 : Calling all New Database Administrators (PPT)DBA 101 : Calling all New Database Administrators (PPT)
DBA 101 : Calling all New Database Administrators (PPT)
Gustavo Rene Antunez
NetFlow Monitoring Standard Content Guide for ESM 6.5c
NetFlow Monitoring Standard Content Guide for ESM 6.5c	NetFlow Monitoring Standard Content Guide for ESM 6.5c
NetFlow Monitoring Standard Content Guide for ESM 6.5c
Protect724migration
Remote Log Analytics Using DDS, ELK, and RxJS
Remote Log Analytics Using DDS, ELK, and RxJSRemote Log Analytics Using DDS, ELK, and RxJS
Remote Log Analytics Using DDS, ELK, and RxJS
Sumant Tambe
"Data Provenance: Principles and Why it matters for BioMedical Applications"
"Data Provenance: Principles and Why it matters for BioMedical Applications""Data Provenance: Principles and Why it matters for BioMedical Applications"
"Data Provenance: Principles and Why it matters for BioMedical Applications"
Pinar Alper
Oracle forensics 101
Oracle forensics 101Oracle forensics 101
Oracle forensics 101
fangjiafu
Introduction to Data management services
Introduction to Data management servicesIntroduction to Data management services
Introduction to Data management services
SornarajaThasma1
Esm scg net_flow_6.0c
Esm scg net_flow_6.0c Esm scg net_flow_6.0c
Esm scg net_flow_6.0c
Protect724v3
Standard Provenance Reporting and Scientific Software Management in Virtual L...
Standard Provenance Reporting and Scientific Software Management in Virtual L...Standard Provenance Reporting and Scientific Software Management in Virtual L...
Standard Provenance Reporting and Scientific Software Management in Virtual L...
njcar
Network Monitoring Standard Content Guide for ESM 6.8c
Network Monitoring Standard Content Guide for ESM 6.8cNetwork Monitoring Standard Content Guide for ESM 6.8c
Network Monitoring Standard Content Guide for ESM 6.8c
Protect724migration
Attack monitoring using ElasticSearch Logstash and Kibana
Attack monitoring using ElasticSearch Logstash and KibanaAttack monitoring using ElasticSearch Logstash and Kibana
Attack monitoring using ElasticSearch Logstash and Kibana
Prajal Kulkarni
Security Automation Simplified via NIST OSCAL: Were Not in Kansas Anymore
Security Automation Simplified via NIST OSCAL: Were Not in Kansas AnymoreSecurity Automation Simplified via NIST OSCAL: Were Not in Kansas Anymore
Security Automation Simplified via NIST OSCAL: Were Not in Kansas Anymore
Priyanka Aash
2012-10-16 Mil-OSS Working Group: Introduction to SCAP Security Guide
2012-10-16 Mil-OSS Working Group: Introduction to SCAP Security Guide2012-10-16 Mil-OSS Working Group: Introduction to SCAP Security Guide
2012-10-16 Mil-OSS Working Group: Introduction to SCAP Security Guide
Shawn Wells
Analysis of Database Issues using AHF and Machine Learning v2 - SOUG
Analysis of Database Issues using AHF and Machine Learning v2 -  SOUGAnalysis of Database Issues using AHF and Machine Learning v2 -  SOUG
Analysis of Database Issues using AHF and Machine Learning v2 - SOUG
Sandesh Rao
Analysis of Database Issues using AHF and Machine Learning v2 - AOUG2022
Analysis of Database Issues using AHF and Machine Learning v2 -  AOUG2022Analysis of Database Issues using AHF and Machine Learning v2 -  AOUG2022
Analysis of Database Issues using AHF and Machine Learning v2 - AOUG2022
Sandesh Rao
Getting optimal performance from oracle e-business suite presentation
Getting optimal performance from oracle e-business suite presentationGetting optimal performance from oracle e-business suite presentation
Getting optimal performance from oracle e-business suite presentation
Berry Clemens
Security defined routing_cybergamut_v1_1
Security defined routing_cybergamut_v1_1Security defined routing_cybergamut_v1_1
Security defined routing_cybergamut_v1_1
Joel W. King
Cdcr apachecon-talk
Cdcr apachecon-talkCdcr apachecon-talk
Cdcr apachecon-talk
Amrit Sarkar
Dynamics ax performance tuning
Dynamics ax performance tuningDynamics ax performance tuning
Dynamics ax performance tuning
OutsourceAX
Whats Evolving in the Elastic Stack
Whats Evolving in the Elastic StackWhats Evolving in the Elastic Stack
Whats Evolving in the Elastic Stack
Elasticsearch
Spark and Couchbase: Augmenting the Operational Database with Spark
Spark and Couchbase: Augmenting the Operational Database with SparkSpark and Couchbase: Augmenting the Operational Database with Spark
Spark and Couchbase: Augmenting the Operational Database with Spark
Spark Summit
DBA 101 : Calling all New Database Administrators (PPT)
DBA 101 : Calling all New Database Administrators (PPT)DBA 101 : Calling all New Database Administrators (PPT)
DBA 101 : Calling all New Database Administrators (PPT)
Gustavo Rene Antunez
NetFlow Monitoring Standard Content Guide for ESM 6.5c
NetFlow Monitoring Standard Content Guide for ESM 6.5c	NetFlow Monitoring Standard Content Guide for ESM 6.5c
NetFlow Monitoring Standard Content Guide for ESM 6.5c
Protect724migration
Remote Log Analytics Using DDS, ELK, and RxJS
Remote Log Analytics Using DDS, ELK, and RxJSRemote Log Analytics Using DDS, ELK, and RxJS
Remote Log Analytics Using DDS, ELK, and RxJS
Sumant Tambe
"Data Provenance: Principles and Why it matters for BioMedical Applications"
"Data Provenance: Principles and Why it matters for BioMedical Applications""Data Provenance: Principles and Why it matters for BioMedical Applications"
"Data Provenance: Principles and Why it matters for BioMedical Applications"
Pinar Alper
Oracle forensics 101
Oracle forensics 101Oracle forensics 101
Oracle forensics 101
fangjiafu
Introduction to Data management services
Introduction to Data management servicesIntroduction to Data management services
Introduction to Data management services
SornarajaThasma1
Esm scg net_flow_6.0c
Esm scg net_flow_6.0c Esm scg net_flow_6.0c
Esm scg net_flow_6.0c
Protect724v3
Standard Provenance Reporting and Scientific Software Management in Virtual L...
Standard Provenance Reporting and Scientific Software Management in Virtual L...Standard Provenance Reporting and Scientific Software Management in Virtual L...
Standard Provenance Reporting and Scientific Software Management in Virtual L...
njcar
Network Monitoring Standard Content Guide for ESM 6.8c
Network Monitoring Standard Content Guide for ESM 6.8cNetwork Monitoring Standard Content Guide for ESM 6.8c
Network Monitoring Standard Content Guide for ESM 6.8c
Protect724migration
Attack monitoring using ElasticSearch Logstash and Kibana
Attack monitoring using ElasticSearch Logstash and KibanaAttack monitoring using ElasticSearch Logstash and Kibana
Attack monitoring using ElasticSearch Logstash and Kibana
Prajal Kulkarni

Concept scap

  • 1. Datastream http://martin.preisler.me/category/scap/page/2 Datastream can be thought of as an archive of interlinked SCAP content(XCCDF,OVAL,CPE,)
  • 2. Type of datastream Source datastream (SDS) Result datastream (ARF) >> The scanner takes a SDS, evaluates and gives results in the ARF format back.
  • 3. Source Datastream Has a root element called data-stream-collection. data-stream-collection contains 1 or more elements called data- stream. >>> each SDS has 1 or more modes in which it can be evaluated.
  • 4. National Checklist Program (NCP) See NIST Special Publication 800-70 Rev.2 Frequently Asked Questions: General Information >> http://web.nvd.nist.gov/view/ncp/information
  • 5. Security Configuration Checklist Also called lockdown, hardening guide, benchmark, security technical implementation guide (STIG). Series of instruction for configuring a product to particular operational environment. Can comprise templates, automated scripts, patches or patch descriptions, XML files, and other procedures.
  • 6. NIST maintains the National Checklist Repository. http://checklists.nist.gov/
  • 7. Selecting checklists? Checklist users should carefully consider the degree of automation and the source of each checklist. NIST defined 4 tiers of checklists to assist users. Tier1 checklists: are prose-based with narrative descriptions of how a person can manually alter a products configuration. Tier4 checklists: have all security settings documented in machine- readable, standardized Security Content Automation Protocol (SCAP) formats,.. (see SP 800-70 Rev2).