Tenable and SANS Consensus Audit Guidelines (CAG)

The SANS Consensus Audit Guidelines (CAG) is a compliance standard that specifies 20 "control points" that have been identified through a consensus of federal and private industry security professionals. This blog post provides a summary of the SANS initiative and an overview of how Tenable’s solutions can be leveraged to demonstrate compliance with these guidelines. Tenable has also released a technical white paper that shows exactly how our scanning, log analysis and auditing solutions can be used to monitor the SANS-CAG controls.

Background

The U.S. government is in the process of launching an initiative to restructure federal computer security practices. The ICE Act of 2009 is proposed legislation that seeks to unify security efforts under a federal “cyber office” that reports directly to the president. Quoting from the OpenCongress website , the ICE Act is:

“A bill to amend chapter 35 of title 44, United States Code, to recognize the interconnected nature of the Internet and agency networks, improve situational awareness of Government cyberspace, enhance information security of the Federal Government, unify policies, procedures, and guidelines for securing information systems and national security systems, establish security standards for Government purchased products and services, and for other purposes.”

The SANS-CAG initiative is designed to help the federal government prioritize resources and consolidate efforts to reduce costs and ensure that critical security issues are addressed. Anyone who has endured a compliance audit knows that one of the most tedious aspects is reviewing the hundreds of control points with the auditors, many of which only have a subtle nuance of difference in the real world and can be addressed by the same mitigating action. For example, NIST has 20 controls just for access control. In an audit, each of these must be discussed separately but they could all be summarized under one heading and addressed at the same time. This would greatly speed up the audit process and reduce costs. This is the goal of the SANS-CAG project.

How Tenable Can Help

Tenable has prepared a whitepaper describing how our solutions can be used to demonstrate compliance with SANS-CAG. This paper includes a technical table that lists each SANS-CAG control point, our interpretative summary of the control point and a brief description of how Tenable’s scanning, log analysis and network monitoring solutions apply to the control point.

Tenable Network Security was founded on the belief that it is crucial to monitor for compliance in a manner as close to real-time as possible to ensure the organization does not drift out of compliance over time. Tenable’s Unified Security Monitoring (USM) approach easily fits into the SANS-CAG model by providing a unique blend of real-time vulnerability monitoring (24x7 discovery through remediation), critical log/event monitoring and custom compliance monitoring capabilities in a single, role-based, interface for IT and security users to evaluate, communicate and report the results for effective decision making.