Out with the old security configurations, in with the new
Connecting state and local government leaders
The U.S. Government Configuration Baseline is an update of the security configuration requirements for government systems, and NIST is updating its guidance on using checklists to reflect them.
The Federal Desktop Core Configuration settings that specify secure settings for software in government systems are being replaced by a new set of requirements, the U.S. Government Configuration Baselines.
The Technology Infrastructure Subcommittee of the CIO Council Architecture and Infrastructure Committee began the USGCB initiative in 2010 as an evolution of the FDCC policy. USGCB checklists are baselines that define required minimum sets of configurations for government IT systems. Settings for Microsoft Windows 7 and Internet Explorer 8 were released in September.
The National Institute of Standards and Technology is updating its guidance for using configuration checklists to reflect these changes. A draft of a new revision of Special Publication 800-70, “National Checklist Programs for IT Products,” has been released for comment. The new draft updates the previous version of the document, released in 2009, primarily with new information on Security Content Automation Protocol content related to USGCB.
Related coverage:
Windows 7 could arrive with security settings ready
The new baseline program is part of the National Checklist Program, a resource to help software users find and use the proper security configuration checklists for their organizations. It provides guidelines for the development of security configuration checklists for IT products by product vendors and by third parties. NIST established the program and maintains the National Checklist Repository. SP 800-70 describes the program and explains how to use it. It also describes the policies, procedures and general requirements for participation in the NCP.
A security configuration checklist provides instructions for configuring a particular software product to meet the security needs of a particular operational environment. They can consist of templates or automated scripts, Extensible Markup Language files or other procedures, and can include patches and patch descriptions for the software. Checklists are helpful, even necessary, because of the variability and complexity of IT systems and applications.
The FDCC broke ground in 2007 when the Office of Management and Budget required the use of baseline configuration requirements for Windows XP and Vista. The configurations were developed by NIST in collaboration with OMB, government security agencies and Microsoft. FDCC compliance was intended to be done with Security Content Automation Protocols tools that would automate the job of checking and setting configuration.
Because they are baseline configurations, FDCC — and now USGCB — are intended as minimum requirements, and agencies are expected to customize them as necessary to meet their needs when more security is needed. These changes are expected to be documented and tracked.
Changes in USGCB requirements for Windows 7 and IE8 from the original FDCC configuration settings include an increased focus on green IT, and the requirement that computers go into “sleep” mode after 60 minutes of inactivity. The monitor will go into “sleep” mode after 20 minutes of inactivity. The baselines also include conditional setting for features such as IPv6 and wireless connectivity, applicable only to agencies using such features. These USGCB settings will be harmonized with Windows Vista, XP and IE 7 where appropriate to ensure a consistent baseline.
Key features of the USGCB for Windows 7 and IE 8 include:
-
Settings that are the result of a collaborative effort between the Defense and Homeland Security departments, NIST, the Technology Infrastructure Subcommittee, and other members of the federal information security community.
-
Reduced risk of exploit of yet-to-be discovered vulnerabilities as well as current security issues.
-
Group Policy and virtual machine disk images to facilitate testing and deployment.
-
SCAP Content to support compliance testing and reporting.
Comments on draft SP 800-70 Revision 2 should be sent by Jan. 31 to 800-70comments@nist.gov with "Comments SP 800-70" in the subject line.
NEXT STORY: Microsoft rolls out HTML5 Labs test site