Tenable and SANS Consensus Audit Guidelines (CAG)
The SANS Consensus Audit Guidelines (CAG) is a compliance standard that specifies 20 "control points" that have been identified through a consensus of federal and private industry security professionals. This blog post provides a summary of the SANS initiative and an overview of how Tenable’s solutions can be leveraged to demonstrate compliance with these guidelines. Tenable has also released a technical white paper that shows exactly how our scanning, log analysis and auditing solutions can be used to monitor the SANS-CAG controls.
The U.S. government is in the process of launching an initiative to restructure federal computer security practices. The ICE Act of 2009 is proposed legislation that seeks to unify security efforts under a federal “cyber office” that reports directly to the president. Quoting from the OpenCongress website , the ICE Act is:
“A bill to amend chapter 35 of title 44, United States Code, to recognize the interconnected nature of the Internet and agency networks, improve situational awareness of Government cyberspace, enhance information security of the Federal Government, unify policies, procedures, and guidelines for securing information systems and national security systems, establish security standards for Government purchased products and services, and for other purposes.”
Tenable has prepared a whitepaper describing how our solutions can be used to demonstrate compliance with SANS-CAG. This paper includes a technical table that lists each SANS-CAG control point, our interpretative summary of the control point and a brief description of how Tenable’s scanning, log analysis and network monitoring solutions apply to the control point.
Tenable Network Security was founded on the belief that it is crucial to monitor for compliance in a manner as close to real-time as possible to ensure the organization does not drift out of compliance over time. Tenable’s Unified Security Monitoring (USM) approach easily fits into the SANS-CAG model by providing a unique blend of real-time vulnerability monitoring (24x7 discovery through remediation), critical log/event monitoring and custom compliance monitoring capabilities in a single, role-based, interface for IT and security users to evaluate, communicate and report the results for effective decision making.