Re: [Fed-Talk] Proposed Interim Leopard Benchmark
Re: [Fed-Talk] Proposed Interim Leopard Benchmark
- Subject: Re: [Fed-Talk] Proposed Interim Leopard Benchmark
- From: Todd Heberlein <email@hidden>
- Date: Mon, 29 Oct 2007 10:50:37 -0700
Why is the SCAP project important? A recent OMB memo stated that
all Federal systems (Windows only at the moment) will have to
comply with the Federal Desktop Core Configuration (FDCC, http://
csrc.nist.gov/fdcc/) mandate and SCAP is the protocol being used to
configure and validate the configuration of the desktops.
I wish them better luck than the Computer Security Act of 1987. It
mandated C2-level auditing capability for all computers by 1992
(anyone remember "C2 by 92"?), and I worked with LLNL to develop a
hybrid host and network-based IDS for the government by 1992.
Unfortunately, it was virtually impossible to find people using audit
trails then (as it is now).
In about the same timeframe we also worked with LLNL on the Security
Profile Inspector (SPI), or what the Air Force guys used to jokingly
call the Security Profile Inspector Tool (SPIT). It had a lot of
similarities with SCAP. It eventually died.
Interestingly, one of the key Air Force program managers who was
trying to bring these tools into the Air Force back then (they funded
LLNL security R&D for a number of years) is now a security program
manager at NIST. So maybe this is a second try.
Not that I think SCAP is bad or anything, but I just have a lot of
scar tissue from relying on promises, mandates, laws, etc. that end
up falling by the wayside or just becoming exercises in "check off
the box".
Todd
_______________________________________________
Do not post admin requests to the list. They will be ignored.
Fed-talk mailing list (email@hidden)
Help/Unsubscribe/Update your Subscription:
This email sent to email@hidden