Tripwire Receives Security Content Automation Protocol (SCAP) Validation From NIST

Portland, OR - Aug 16, 2010 - Tripwire Inc., a leading global provider of IT security and compliance automation solutions, today announced the Security Content Automation Protocol (SCAP) validation of Tripwire®Enterprise 8.0. Tripwire Enterprise SCAP validation supports the U.S. Office of Management and Budget (OMB) Federal Desktop Core Configuration (FDCC) mandate, and added support for Microsoft Windows Server 2008 R2 and Red Hat Enterprise Linux 5.4.

“Protecting US federal government data and critical infrastructures against cyber security threats is priority number one for the US government. SCAP is more than an OMB mandate, it’s a tremendous opportunity to fortify, a standards-based security posture across all agencies,” said Randy Crow, Vice-President, US Federal Government for Tripwire. “Providing a SCAP validated Tripwire Enterprise solution is a natural extension of what we’ve been providing for over 10 years, a world-class file integrity monitoring and configuration control solution.”
Built on the Tripwire Enterprise solution’s trusted IT security platform, the new capabilities blend SCAP-aligned improvements with traditional Tripwire Enterprise strengths. Differences between existing implementations and new SCAP-enabled implementations include:  

  • Language differences: SCAP runs a special XML language called OVAL (Open Vulnerability Assessment Language) and specifies the methods in the internal language used by Tripwire Enterprise.  Rules made in the SCAP OVAL format are slightly more specific and complex than those normally found in the Tripwire Enterprise solution.
  • Format differences:  SCAP is not proprietary, and in fact uses an open format for content interoperability called the “eXtensible Checklist Configuration Description Format,” or XCCDF.  That means SCAP tests and results can be used on any SCAP validated product, and that different groups such as government agencies can share SCAP policies. Through XCCDF, the Office of Management and Budget has a standard format for reporting and the ability to “roll up” compliance reporting throughout the government offices.
  • Specificity: Unlike the Tripwire Enterprise solution’s native configuration assessment capabilities, the new SCAP capabilities specify additional test “states” that include more than pass/fail. Apart from “pass” or “fail,” a test can be reported as “error,” “not applicable,” “unknown,” and “not evaluated.”
  • Open Source Content: The Tripwire Enterprise solution’s SCAP feature imports “SCAP content” that is published freely from NIST and submitted by an open source volunteer community.

As part of the new SCAP functionality, Tripwire Enterprise users can easily import content “bundles” from NIST that assess their target machine against:

  • Windows XP system standards
  • Windows Vista system standards
  • Internet Explorer 7 implementations
  • Windows firewall setting standards

Once the tests have been executed against the target machine, Tripwire Enterprise users can easily examine detailed policy tests and export them in the common XCCDF format.
The Tripwire Enterprise 8.0 solution has also been FIPS 140-2 certified, and its Center for Internet Security (CIS) policies have been recertified across 28 platforms, applications and devices.

About Tripwire, Inc.
Tripwire is a leading global provider of IT security and compliance automation solutions that help businesses and government agencies take control of their IT infrastructure. Thousands of customers rely on Tripwire's integrated solutions to help protect sensitive data, prove compliance and prevent outages. Tripwire VIA, the comprehensive suite of industry-leading file integrity, policy compliance and log and event management solutions, is the way organizations proactively achieve continuous compliance, mitigate risk, and ensure operational control through Visibility, Intelligence and Automation. Learn more at and @TripwireInc on Twitter.