Energy gets behind new security language standard

SAN FRANCISCO'The Energy Department this spring will launch a new Security Incident Response Portal to ease management of vulnerabilities in DOE systems.

The department's Computer Incident Advisory Capability will deploy the portal in May as a prototype service for a new language standard for Web application vulnerabilities, said John Dias, senior security analyst at CIAC.

The announcement this week at the RSA Security Conference spotlights the new Application Vulnerability Description Language, a proposed standard of the Organization for the Advancement of Structured Information Standards.

AVDL is an Extensible Markup Language schema to allow data sharing between application security products from different vendors. Its developers, including DOE, are promoting AVDL as an alternative to analysts and administrators eyeballing and rewriting scores of text vulnerability alerts.

'We're just starting to evangelize it,' Dias said, hoping to speed the standard's adoption.

OASIS is considering AVDL Version 1.0 during a 30-day comment period that ends March 7. The language's adoption as a formal standard is expected next month.

OASIS announced its AVDL Technical Committee at last year's RSA conference and said it would address the growing problem of vulnerabilities and threats against Web applications.

'As networks are hardened and patched, applications have become the target of choice as they are Web-enabled,' said Brian Cohen, chief executive officer of SPI Dynamics Inc. of Atlanta, a founding member of the AVDL Technical Committee. 'Putting on a Web interface can introduce new vulnerabilities.'

Dias called Web services 'the emerging monster' and said as many as 70 percent of all new vulnerabilities reported are in the application layer.

CIAC, established in 1989 to provide security services to DOE and the National Nuclear Security Administration, monitors such weaknesses.

'CIAC scours the Internet, looking for vulnerabilities information,' Dias said. 'And we're real good at it. But we're being overwhelmed.'

The organization subscribes to vendor and research group e-mail lists to receive word of newly discovered vulnerabilities and threats. But these alerts have no common format, and the Energy staff must analyze and rewrite them for CIAC's customers, depending on the hardware and software platforms each is using.

Not only is the number of reported vulnerabilities growing, the time between their announcement and the appearance of an exploit attacking them is shrinking. For the Nimda worm, that window was almost a year.

'From the time we announced the bulletin to the time the worm hit was 331 days, and it still was successful,' Dias said. The window for the Slammer worm was about 180 days and for Welchia 151 days. For the Blaster worm, the window was 25 days.

'We all warned the communities, and yet these worms were all pretty successful,' he said. 'It occurred to us that this e-mail subscription and hand-searching is probably not going to scale.'

The answer could be an automated system using a standard language. The Security Incident Response Portal, an XML-enabled Oracle Corp. application running on servers at CIAC in Livermore, Calif., will provide the automation. AVDL will provide the language. The portal will listen for AVDL alerts, process them and pass them on to customers automatically, Dias said.

Several vendors are demonstrating AVDL-compliant products at the conference. SPI Dynamics' WebInspect can do vulnerability assessments of applications, and users can export the results in AVDL to products such as the security gateway from NetContinuum Inc. of Santa Clara, Calif. The gateway can read the report and generate recommendations in AVDL for products such as the Hercules automated remediation tool from Citadel Security Software Inc. of Dallas.

Dias envisions the CIAC portal becoming a Web service for subscribers who would receive AVDL alerts that their systems could automatically act upon.

All of this depends on industry adopting the standard. Besides Citadel, NetContinuum and SPI Dynamics, companies that have announced AVDL-compliant products include: Cenzic Inc. of Campbell, Calif.; GuardedNet Inc. of Atlanta; Qualys Inc. of Redwood Shores, Calif.; Teros Inc. of Sunnyvale, Calif.; and WhiteHat Security Inc. of Santa Clara, Calif.

'The next step is to get the big players actively involved,' Cohen said.

Large companies, such as IBM Corp. and Microsoft Corp., typically have focused on network layer security rather than applications or have their product suites using proprietary formats to communicate.

But the need for standardization has generated a positive response for AVDL, said Wes Wasson, chief strategist for NetContinuum.

'They're telling us, 'We hope you get it figured out because it's something we get hit with every day,' ' Wasson said.