Category Archives: Security

The previous article introduced SCAP technologies. While the SCAP technologies are interesting, they have limited value without security content – the actual set of security tests run by SCAP. Fortunately there is a good set of content available that can … Continue reading →

The previous article introduced the concept of security guides as executable content and introduced SCAP. We’re going to dig into SCAP in a fair amount of detail. So, let’s start by covering the various technologies that make up SCAP: XCCDF … Continue reading →

The last article introduced the US National Checklist Program. Security automation can be defined as the use of standardized specifications and protocols to perform specific common security functions. Which leads us to SCAP – the Security Content Automation Protocol, an … Continue reading →

The last article introduced the need to automate security. If you are going to perform a security audit you need a checklist. Let’s spend a minute on this. If you want a predictable outcome, you need a standard process – … Continue reading →

The last post concluded with the cry “there has to be a better way!”. So far we have established: Security Guides are a good idea and exist in almost all organizations. Security audits are good and widely used. Security guides … Continue reading →

The last post laid out guidelines for a security guide. We’re now at the point where we can discuss a system audit. We have defined what an audit is, what security requirements are, and what a security guide is. At … Continue reading →

The previous post explored the kinds of information that might be in a security guide. Let’s lay out some basic requirements for a security guide: The security guide must exist. It must be available, updated, and maintained. The security guide … Continue reading →

The last article introduced the concept of a security guide – but what is it? In many cases a security guide is a binder full of often vague, occasionally overly specific and sometimes conflicting requirements. It has usually grown and … Continue reading →