NIST SP 800-137

From: NIST

The August 1^st, 2011 deadline for public comments on the Draft Special Publication (SP) 800-126 Revision 2, The Technical Specification for the Security Content Automation Protocol (SCAP): SCAP Version 1.2 and the Draft Interagency Report (IR) 7802, Trust Model for Security Automation Data (TMSAD) Version 1.0 is approaching.  Your feedback is important to us to insure the best possible final documents. We appreciate the thorough comments we have received to date.

If you plan to provide feedback, please submit SP 800-126 Revision 2 comments to 800-126comments@nist.gov with “Comments SP 800-126” in the subject line, and IR 7802 comments to ir7802comments@nist.gov with “Comments IR 7802” in the subject line. Public comments may also be posted to scap-dev@nist.gov.

From: FierceGovernmentIT

From NIST Tech Beat: July 19, 2011

Contact: Evelyn Brown
301-975-5661

Researchers at the National Institute of Standards and Technology (NIST) have released for public comment updated specifications for the Security Content Automation Protocol (SCAP), which helps organizations find and manage computer-system vulnerabilities more effectively by standardizing the way vulnerabilities are identified, prioritized and reported.

SCAP unites and organizes a collection of computer security specifications and reference data to support automated security programs that check vulnerabilities in information systems, such as configuration errors, missing software “patches,” misapplied security settings and many others. SCAP-based security tools are particularly valuable for securing large, complex information systems and organizations with many distributed computing systems.

In testimony before the Oversight and Investigations Subcommittee of the House Financial Services Committee, Alan Paller of the SANS Institute emphasized the importance of continuous monitoring.  Mr. Paller also emphasized the cost-effective nature of continuous monitoring in his testimony.

The great shame is that doing security right  can cost less than we spend now to do it wrong. The waste was documented by a Senate oversight committee Chairman, who pointed out that billions are being paid to contractors, at a rate of more than $1,000 per page, for millions of pages of useless reports documenting out-of-date and generally less important security problems.

From: Forbes