Specification for the extensible configuration checklist description format (XCCDF) version 1.2

Abstract

(ITL) at the National Institute of Standards and Technology (NIST) promotes the U.S. economy and public welfare by providing technical leadership for the nation's measurement and standards infrastructure. ITL develops tests, test methods, reference data, proof of concept implementations, and technical analysis to advance the development and productive use of information technology. ITL's responsibilities include the development of technical, physical, administrative, and management standards and guidelines for the cost-effective security and privacy of sensitive unclassified information in Federal computer systems. This Interagency Report discusses ITL's research, guidance, and outreach efforts in computer security and its collaborative activities with industry, government, and academic organizations. Certain commercial entities, equipment, or materials may be identified in this document in order to describe an experimental procedure or concept adequately. Such identification is not intended to imply recommendation or endorsement by the National Institute of Standards and Technology, nor is it intended to imply that the entities, materials, or equipment are necessarily the best available for the purpose.

Enhancing Security Testing via Automated Replication of IT-Asset Topologies

“…In this format, checklist items can be associated with checks, such as OVAL definitions, and preconditions, such as preliminary checks that are represented by the <xccdf:require> element. A common example for an require element highlighted in the XCCDF specification [9] is "<xccdf:requires idref="xccdf_org.example_rule_passwd-exists"/>". This kind of preliminary requirement is found in checklist items to evaluate certain file system privileges.…”

“…SCAP also employs the eXtensible Configuration Checklist Description Format (XCCDF [9]). In this format, checklist items can be associated with checks, such as OVAL definitions, and preconditions, such as preliminary checks that are represented by the <xccdf:require> element.…”

“…At this point, our IRP relies on a manually composed, machine-readable discrepancy list that can be processed by an OVAL definition automatically. Every security test to be conducted in the VE has to be provided in the Extensible Configuration Checklist Description Format (XCCDF [9]). Each checklist item of this security test checklist refers to a security test represented by an OVAL definition element.…”

Enterprise Risk Assessment Based on Compliance Reports and Vulnerability Scoring Systems

“…The Extensible Configuration Checklist Description Format (XCCDF) [9], a SCAP specification, specifies a language to describe security checklists and collect compliance results of targeted systems. SCAP also provides a set of measurement and scoring systems to provide universal scores of known vulnerabilities.…”

Security transparency: the next frontier for security research in the cloud

“…While patterns of events [67] (including event counters, conjunction, disjunction and sequences of events) could be readily reuse or extended to reflect the complexity of events of interest to the cloud stakeholders, existing event specification languages such as ETALIS [69], TESLA [70] and YALES [71] are amongst the most expressive languages that can be adopted for the specification of event patterns pertinent to STMA. Furthermore, given most STMA related events would be related to security, candidate format for representing atomic events of interest may include the Extensible Configuration Checklist Description Format -XCCDF [72] and the Intrusion Detection Message Exchange Format-IDMEF (http:// www.rfc-base.org/txt/rfc-4765.txt), both being an XML based format. While IDMEF is intended to be a standard data format that automated intrusion detection systems can use to report alerts about events that they deem suspicious, XCCDF is used to specify security checklists and benchmarks amongst others.…”