Configuration assessment as a service

Abstract

Security of systems is most often compromised by misconfiguration rather than a lack of security mechanisms. As a result, configuration validation is of utmost importance within organizations. However, security policies, best-practices, and documentation of vulnerabilities are usually available in natual language and thus configuration validation is usually a manual and error-prone activity. Initiatives such as the Security Content Automation Protocol foster the automation of configuration validation and the exchange of configuration information by providing a standard language. However they only focus on single systems and are not flexible with respect to the creation of new security content. This paper proposes a tool for configuration validation as a service able to assess check and checklists defined over configurations of both generic and specific distributed systems. © 2013 Springer-Verlag.