NIST SP 800-126A 日本語訳

NIST Special Publication 800-126A

An Annex to NIST Special Publication 800-126 Revision 3

Harold Booth David Waltermire Lee Badger Melanie Cook Stephen D. Quinn Karen Scarfone

This publication is available free of charge from: https://doi.org/10.6028/NIST.SP.800-126A

NIST Special Publication 800-126A

An Annex to NIST Special Publication 800-126 Revision 3

Harold Booth David Waltermire Lee Badger Melanie Cook Stephen D. Quinn

Computer Security Division Information Technology Laboratory

Karen Scarfone Scarfone Cybersecurity Clifton, Virginia

This publication is available free of charge from: https://doi.org/10.6028/NIST.SP.800-126A

February 2018

U.S. Department of Commerce Wilbur L. Ross, Jr., Secretary

National Institute of Standards and Technology

Walter Copan, NIST Director and Under Secretary of Commerce for Standards and Technology

This publication has been developed by NIST in accordance with its statutory responsibilities under the Federal Information Security Modernization Act (FISMA) of 2014, 44 U.S.C. § 3551 et seq., Public Law (P.L.) 113-283. NIST is responsible for developing information security standards and guidelines, including minimum requirements for federal information systems, but such standards and guidelines shall not apply to national security systems without the express approval of appropriate federal officials exercising policy authority over such systems. This guideline is consistent with the requirements of the Office of Management and Budget (OMB) Circular A-130.

Nothing in this publication should be taken to contradict the standards and guidelines made mandatory and binding on federal agencies by the Secretary of Commerce under statutory authority. Nor should these guidelines be interpreted as altering or superseding the existing authorities of the Secretary of Commerce, Director of the OMB, or any other federal official. This publication may be used by nongovernmental organizations on a voluntary basis and is not subject to copyright in the United States. Attribution would, however, be appreciated by NIST.

National Institute of Standards and Technology Special Publication 800-126A Natl. Inst. Stand. Technol. Spec. Publ. 800-126A, 21 pages (February 2018) CODEN: NSPUE2

This publication is available free of charge from: https://doi.org/10.6028/NIST.SP.800-126A

Comments on this publication may be submitted to: National Institute of Standards and Technology Attn: Computer Security Division, Information Technology Laboratory 100 Bureau Drive (Mail Stop 8930) Gaithersburg, MD 20899-8930 Email: 800-126comments@nist.gov

All comments are subject to release under the Freedom of Information Act (FOIA).

The Information Technology Laboratory (ITL) at the National Institute of Standards and Technology (NIST) promotes the U.S. economy and public welfare by providing technical leadership for the Nation’s measurement and standards infrastructure. ITL develops tests, test methods, reference data, proof of concept implementations, and technical analyses to advance the development and productive use of information technology. ITL’s responsibilities include the development of management, administrative, technical, and physical standards and guidelines for the cost-effective security and privacy of other than national security-related information in federal information systems. The Special Publication 800-series reports on ITL’s research, guidelines, and outreach efforts in information system security, and its collaborative activities with industry, government, and academic organizations.

The Security Content Automation Protocol (SCAP) is a multi-purpose framework of component specifications that support automated configuration, vulnerability, and patch checking, security measurement, and technical control compliance activities. The SCAP version 1.3 specification is defined by the combination of NIST Special Publication (SP) 800-126 Revision 3, a set of schemas, and this document. This document allows the use of particular minor version updates to SCAP 1.3 component specifications and the use of particular Open Vulnerability and Assessment Language (OVAL) core schema and platform schema versions. Allowing use of these updates and schemas provides additional functionality for SCAP 1.3 without causing any loss of existing functionality.

Open Vulnerability and Assessment Language (OVAL); security automation; security configuration; Security Content Automation Protocol (SCAP)

The authors, Harold Booth, David Waltermire, Lee Badger, Melanie Cook, and Stephen D. Quinn of the National Institute of Standards and Technology (NIST) and Karen Scarfone of Scarfone Cybersecurity wish to thank their colleagues who reviewed drafts of this document and contributed to its technical content, particularly Stephen Banghart and Joshua Lubell of NIST, and Dragos Prisaca of G2, Inc.

All trademarks and registered trademarks belong to their respective organizations.

This table will contain changes that have been incorporated into NIST Special Publication 800-126A after the publication is finalized. Errata updates can include corrections, clarifications, or other minor changes in the publication that are either editorial or substantive in nature.

Specification versioning is the process of denoting a revision to a specification by changing its version number. For example, the Security Content Automation Protocol (SCAP) specification documents are updated from time to time, and these updates trigger an increase in the SCAP version number (1.0, 1.1, 1.2, etc.) What makes specification versioning challenging is that there is no standard convention or terminology for it; each specification imparts different meanings into its version numbers. For example, moving from version 3.4 to version 3.5 might break backward compatibility for one specification, add new functionality for another specification, and simply correct an error in a third specification.

This document defines two key terms for SCAP 1.3 component specification versioning: major and minor version updates. A major version update is a revision of a specification that breaks backward compatibility with the previous revision of the specification in numerous significant ways. A minor version update is a revision of a specification that may add or enhance functionality, fix bugs, and make other changes from the previous revision, but the changes have minimal impact, if any, on backward compatibility.

The purpose of this document is to extend the contents of NIST Special Publication (SP) 800-126 Revision 3¹ so that SCAP 1.3 is defined by the combination of the two documents and the set of schemas. Readers should be familiar with NIST SP 800-126 Revision 3 before reading this document.

This document can only be used to make minor version updates of component specifications already included in SCAP 1.3 by NIST SP 800-126 Revision 3. Major version updates to SCAP 1.3 component specifications, as well as new component specifications not included in NIST SP 800-126 Revision 3, can only be added to a future version of SCAP as documented in a future revision of NIST SP 800-126.

Each SCAP 1.3 extension specified in this document takes one of two forms. First, it may allow the use of particular minor version updates to SCAP 1.3 component specifications, or the use of particular Open Vulnerability and Assessment Language (OVAL) platform schema versions that work in conjunction with the OVAL 5.11 core schema included in SCAP 1.3. Second, it may specify one or more requirements for using these updates or OVAL platform schemas in an SCAP 1.3-conformant manner.

This document specifies exactly which component specification minor version updates and OVAL platform schema versions may be used as part of SCAP 1.3 for several reasons, including the following:

While organizations are free to use SCAP 1.3 with any schema or specification that they choose in any manner they choose, such usage is not considered SCAP 1.3-conformant unless defined as such in this document or in NIST SP 800-126 Revision 3.

The scope of this document is versioning for SCAP 1.3 component specifications only.

The rest of this document consists of the following sections and appendices:

This section defines the criteria used to evaluate minor version updates in SCAP 1.3 component specifications for potential inclusion in SCAP 1.3, then lists all such updates that have been approved for inclusion in SCAP 1.3, along with any corresponding requirements added to SCAP 1.3. It also provides the current XML schema (XSD) and Schematron schema locations corresponding to all SCAP 1.3 component specifications.

The following defines the criteria that a minor version update to an SCAP 1.3 component specification and associated requirements must meet before being considered for potential inclusion in this document:

The following SCAP 1.3 component specification minor version updates have been approved for inclusion in SCAP 1.3:

See Table 1 for the schema location for the component specification listed above.

For all other component specifications, the versions listed in NIST SP 800-126 Revision 3 are the approved versions.

As of this writing, no requirements need to be added to SCAP 1.3 to support the approved component specification minor version updates.

Table 1 lists the XML schema (XSD) locations (and Schematron schema locations, when applicable) for the SCAP component specifications. Table 1: SCAP XML Schema and Schematron Schema Locations

OVAL version 5.11 introduced a new versioning policy that was a significant change from previous OVAL versions.⁴ OVAL is now divided into the Core and Platform Extension languages. The Core defines the general functionality for OVAL, while each Platform Extension defines functionality specific to a particular platform, such as an operating system or an application. The Core and Platform Extensions languages can be updated separately, which provides greater flexibility. Interoperability is supported by requiring each Platform Extension to be based on a particular version of the Core.

SCAP 1.3 supports the version(s) of the OVAL core schemas listed in Section 2 of this document. As a result, SCAP 1.3 could be extended to support one or more OVAL platform schemas that are based on the specified version(s) of the OVAL core schemas. Each OVAL platform schema has a composite version number; the first half corresponds to the core schema version it is based on, and the second half corresponds to the version of the platform schema itself. For example, a platform schema with version 5.11.2:1.0 would be the original version (1.0) of a platform schema based on core schema version 5.11.2. Some platform schemas used in SCAP may be based on earlier OVAL core schema versions. This works because the constructs supported in older OVAL core schema versions are expected to be supported in newer 5.x releases.

This section defines the criteria used to evaluate OVAL platform schema versions that work in conjunction with SCAP 1.3-conformant OVAL core schemas for potential inclusion in SCAP 1.3. It then lists all OVAL platform schema versions that have been approved for inclusion in SCAP 1.3, along with any corresponding requirements added to SCAP 1.3.

The following defines the criteria that an OVAL platform schema version and associated requirements must meet before being considered for potential inclusion in this document:

d. The platform schema version provides significant benefits, such as offering a solution for an important use case that previously had no solution. e. SCAP content is available that makes significant use of the platform schema version. f. The OVAL Board has demonstrated that there are significant benefits to using the platform schema version in conjunction with the SCAP 1.3 component specifications.

Table 2 lists the OVAL platform schema versions⁵ that have been approved for inclusion in SCAP 1.3. Note that it is not expected nor desired that all SCAP 1.3-conformant tools will implement all of these OVAL platform schema versions. Table 2 indicates which OVAL platform schema versions are in scope for SCAP 1.3. SCAP 1.3-conformant tools should only implement the ones that are relevant for the purposes of each tool.

Table 2: Approved OVAL Platform Schema Versions

As of this writing, no requirements need to be added to SCAP 1.3 to support the approved OVAL platform schema versions.

This section is reserved for future use in providing additional information on OVAL data types. As of this writing, no additional data types have yet been defined.

As explained in Section 1, the combination of this document, NIST SP 800-126 Revision 3, and the set of schemas defines the SCAP 1.3 specification. Having two documents allows SCAP 1.3 extensions to be defined in a separate document without having to update and re-release NIST SP 800-126 Revision 3 itself each time. It is also more convenient for SCAP tool and content developers to have a separate document that lists only the extensions. The adoption of extensions will be driven by community needs and feedback, major changes to platforms, and other trends and events.

It is reasonable to expect that this document will be updated more often than NIST SP 800-126 Revision 3, but frequent updates to either document are not anticipated. Each update to either document may necessitate corresponding changes to NIST IR 7511, which defines the SCAP Validation Program derived test requirements (DTR). It is expected that revisions to NIST IR 7511 will cite the specific version of this document from which the test requirements are derived.

Selected acronyms and abbreviations used in this document are defined below.

Selected terms used in this document are defined below. See the glossary appendix in NIST SP 800-126 Revision 3 for additional definitions.