Misconfiguration

Question 1

What are the main factors which make secure configuration difficult?

Answer 1

Personal factors: lack of knowledge, lack of experience, other priorities
Environmental factors: Sole responsibility, insufficient Q/A, Time pressure
System factors: Usage of defaults, complexity of the system, legacy support

Also: imprecise laws!

Question 2

What is the idea behind SCAP (Security Content Automation Protocol) and what are its main components?

Answer 2

Idea: standard to enable automated vulnerability management, measurement, and policy compliance evaluation
Components:
- Common Vulnerabilities and Exposures (CVE)
- Extensible Configuration Checklist Description Format (XCCDF)
- Open Vulnerability and Assessment Language (OVAL)

Question 3

What is the idea behind the center for internet security (CIS)?

Answer 3

• publishes security configuration guides (CIS workbench)

- users can contribute to benchmarks by adding rules / changing rules

Question 4

What are some open problems with security configuration?

Answer 4

• how to automate the process? some approaches: OpenSCAP (Linux), Scapolite (Windows)
• how to track differences between CIS guides and our policies