note scap

1. Datastream
http://martin.preisler.me/category/scap/page/2
Datastream can be thought of as an archive of interlinked SCAP
content(XCCDF,OVAL,CPE,…)

2. Type of datastream
• Source datastream (SDS)
• Result datastream (ARF)
>> The scanner takes a SDS, evaluates and gives results in the ARF
format back.

3. Source Datastream
• Has a root element called “data-stream-collection”.
• “data-stream-collection” contains 1 or more elements called “data-
stream”.
>>> each SDS has 1 or more modes in which it can be evaluated.

4. National Checklist Program (NCP)
• See NIST Special Publication 800-70 Rev.2
• Frequently Asked Questions: General Information
>> http://web.nvd.nist.gov/view/ncp/information

5. Security Configuration Checklist
• Also called lockdown, hardening guide, benchmark, security technical
implementation guide (STIG).
• Series of instruction for configuring a product to particular
operational environment.
• Can comprise templates, automated scripts, patches or patch
descriptions, XML files, and other procedures.

6. NIST maintains the National Checklist
Repository.
http://checklists.nist.gov/

7. Selecting checklists?
• Checklist users should carefully consider the degree of automation
and the source of each checklist.
• NIST defined 4 tiers of checklists to assist users.
• Tier1 checklists: are prose-based with narrative descriptions of how a
person can manually alter a product’s configuration.
• Tier4 checklists: have all security settings documented in machine-
readable, standardized Security Content Automation Protocol (SCAP)
formats,….. (see SP 800-70 Rev2).