Standards-Based Automated Remediation: A Remediation Manager Reference Implementation, 2011 Update
This report describes the Software Engineering Institute's (SEI's) 2011 work for the National Security Agency (NSA) to develop standards for automated remediation of vulnerabilities and compliance issues on Department of Defense (DoD) networked systems. The SEI developed a remediation manager reference implementation that demonstrates how evolving standards can communicate and process information on vulnerabilities, compliance issues, remediation policy, and remediation actions. An earlier report, Standards-Based Automated Remediation: A Remediation Manager Reference Implementation (CMU/SEI-11-SR-007), described the project's concept, vision, scope, requirements, and the remediation manager implementation as of December 30, 2010. Since then, the SEI has analyzed additional user scenarios, continued remediation standards development, and added new capabilities to the reference implementation.
The remediation manager can employ standards throughout the compliance issue remediation cycle. Using common formats and languages, the reference implementation ingests scan findings, extracts host compliance issues and vulnerabilities, maps them to remediation actions, builds remediation tasks, transmits remediation tasks to a Remediation Tool on a host system, and receives remediation task execution status from the Remediation Tool. In 2011 the SEI added a standards-based remediation policy management capability, enabling users to examine, tailor, and apply standard DoD policy to meet local needs.
Related Reading
Standards-Based Automated Remediation: A Remediation Manager Reference Implementation
This report is related to the following area(s) of work:
Acquisition SupportSecurity and Survivability
Special Report
CMU/SEI-2011-SR-016
December 2011
Cite This Report
SEI:
Chaki, Sagar; Creel, Rita; Davenport, Jeff; Kinney, Mike; McCormick, Benjamin; & Popeck, Mary. Standards-Based Automated Remediation: A Remediation Manager Reference Implementation, 2011 Update (CMU/SEI-2011-SR-016). Software Engineering Institute, Carnegie Mellon University, 2011. http://www.sei.cmu.edu/library/abstracts/reports/11sr016.cfm
IEEE:
S. Chaki, R. Creel, J. Davenport, M. Kinney, B. McCormick, and M. Popeck, "Standards-Based Automated Remediation: A Remediation Manager Reference Implementation, 2011 Update," Software Engineering Institute, Carnegie Mellon University, Pittsburgh, Pennsylvania, Special Report CMU/SEI-2011-SR-016, 2011. http://www.sei.cmu.edu/library/abstracts/reports/11sr016.cfm
APA:
Chaki, S., Creel, R., Davenport, J., Kinney, M., McCormick, B., & Popeck, M. (2011). Standards-Based Automated Remediation: A Remediation Manager Reference Implementation, 2011 Update (CMU/SEI-2011-SR-016). Retrieved May 21, 2013, from the Software Engineering Institute, Carnegie Mellon University website: http://www.sei.cmu.edu/library/abstracts/reports/11sr016.cfm
CHI:
Chaki, Sagar, Rita Creel, Jeff Davenport, Mike Kinney, Benjamin McCormick, and Mary Popeck. Standards-Based Automated Remediation: A Remediation Manager Reference Implementation, 2011 Update (CMU/SEI-2011-SR-016). Pittsburgh, PA: Software Engineering Institute, Carnegie Mellon University, 2011. http://www.sei.cmu.edu/library/abstracts/reports/11sr016.cfm
MLA:
Chaki, S., Creel, R., Davenport, J., Kinney, M., McCormick, B., & Popeck, M. 2011. Standards-Based Automated Remediation: A Remediation Manager Reference Implementation, 2011 Update (Technical Report CMU/SEI-2011-SR-016). Pittsburgh: Software Engineering Institute, Carnegie Mellon University. http://www.sei.cmu.edu/library/abstracts/reports/11sr016.cfm
Find Us Here
Share This Page
For more information
