Security Automation Simplified via NIST OSCAL: We’re Not in Kansas ...

Ad

Ad

Ad

Ad

Ad

Ad

Ad

Ad

Ad

Ad

Ad

Ad

SESSION ID:
#RSAC
David Waltermire
SECURITY AUTOMATION SIMPLIFIED
VIA NIST OSCAL: WE’RE NOT IN KANSAS
ANYMORE
GRC-F01
Secu...

#RSAC
Agenda
2
We’re not in Kansas anymore
NIST OSCAL: Technical Overview
Where does the yellow brick road lead?
Live Demo...

#RSAC
WE’RE NOT IN KANSAS ANYMORE

#RSAC
Why OSCAL?
4
Information Technology is complex
Security Vulnerabilities are everywhere
Regulatory Frameworks are bur...

#RSAC
Major challenges in security controls
assessment
5
Security controls and profiles are represented in proprietary way...

#RSAC
NIST OPEN SECURITY CONTROLS
ASSESSMENT LANGUAGE (OSCAL)
Technical Overview

SESSION ID:
#RSAC

SESSION ID:
#RSAC

SESSION ID:
#RSAC

SESSION ID:
#RSAC

#RSAC
What is OSCAL?
11
New “Standard of Standards” normalizing how system security controls
and corresponding assessment ...

#RSAC
OSCAL goals
12
Have OSCAL-enabled tools (existing and new) and OSCAL-formatted
content widely available
Have OSCAL u...

#RSAC
A note about terminology
13
OSCAL Term Meaning
Control A safeguard or countermeasure designed to satisfy a set of de...

#RSAC
OSCAL WorkflowHuman-OrientedMachine-Oriented
Control
Documentation
Catalog /
Framework
Select appropriate
catalog(s)...

#RSAC
15
OSCAL is being
developed over a series
of phases using an agile
approach
Through a series of
development sprints,...

#RSAC
16
Phases: 0 and 1 Status: Stable
A normalized model for representing
a control catalog
Normalizes the representatio...

#RSAC
The OSCAL Catalog Format – Other Features
17
A number of other features are also supported:
Inclusion of additional ...

#RSAC
OSCAL Catalog Example
Unstructured Prose Structured OSCAL Catalog XML (partial)
18
<?xml version="1.0" encoding="UTF...

#RSAC
22
The OSCAL Implementation Model
System Security
Plan
Implementation
Align and implement
baseline against
OSCAL-ena...

#RSAC
WHERE DOES THE YELLOW BRICK ROAD
LEAD?
To the Emerald City...duh!

#RSAC
24
Remaining Work
Phases: 3 thru 5 Status: Planned
Provide models that support
automated assessment of control
imple...

#RSAC
OSCAL WorkflowHuman-OrientedMachine-Oriented
Control
Documentation
Catalog /
Framework
Select appropriate
catalog(s)...

#RSAC
LIVE DEMO
Enough talking, time to prove it...

#RSAC
WHY DOES THIS ALL MATTER?
C’mon, I love Word docs and Excel spreadsheets!

#RSAC
Live Poll
28
Do you have compliance programs that operate off of Word
documents and Excel spreadsheets?
Yes
No
Wait....

#RSAC
Why Does this All Matter?
Information Technology andIoT are becoming increasingly complex
Hybrid Cloud deployments a...

#RSAC
Summary
OSCAL serves as the standard of standards to level the playing field
Standardized representation of control ...

#RSAC
Team
31
Project co-leaders:
Email the OSCAL team at oscal@nist.gov
Michaela Iorga
NIST
David Waltermire
NIST

#RSAC
Team
32
Team members:
Email the OSCAL team at oscal@nist.gov
Anil Karmel
C2 Labs
Wendell Piez
C2 Labs
Karen Scarfone...

#RSAC
Apply What You Have Learned Today
33
Next week you should:
Familiarize yourself with the resources available on the ...

#RSAC
Questions and Answers
34
Q&A
Don’t be a cowardly
lion. Ask your
questions
now!
OSCAL Resources
oscal@nist.gov
pages....

Share Slideshare

LinkedIn
Facebook
Twitter

Embed

Size (px)

Show related Slideshows at end

WordPress Shortcode

Link

Share
Email

2024 Trend Updates: What Really Wor... by Search Engine Jou... 1042022 views
Storytelling For The Web: Integrate... by Chiara Aliotta 954721 views
Artificial Intelligence, Data and C... by OECD Directorate ... 880306 views
How to Leverage AI to Boost Employe... by SocialHRCamp 370586 views
2024 State of Marketing Report – by... by Marius Sescu 210442 views
Everything You Need To Know About C... by Expeed Software 229923 views

View on Slideshare

1 of 34 Ad

View on Slideshare

1 of 34 Ad