Photo (C) Ian Glazer All Rights Reserved
Blogger: Bob Blakley
During the Q&A following an SRMS panel I moderated at our recent Catalyst conference, an attendee asked me “What new standard would you most like to see?”. My answer was “A standard defining mechanisms for generation, collection, and disposition of audit events.”
I’ve wanted this for years, but I’ve not held out a lot of hope. Auditing has always been the red-headed stepchild of security; everyone grudgingly agrees that it’s important but no one really wants to work on it, because it’s not cool like cryptography (you’ll never see a black syslog t-shirt declaring itself to be a munition).
Imagine my surprise, then, when my proposal drew a warm and enthusiastic response from the audience. The new emphasis on compliance seems to have made the value of good event auditing much clearer than it was fifteen years ago when I first worked on auditing technology.
Clearer to the users, that is… after listening to the audience express its desire for the sort of standard I’d described, the vendors on the panel all donned serious expressions and talked about how hard it would be to get “the vendors” (as if they were talking about someone else!) to agree on such a standard. One vendor suggested the burden of developing the standard should be handed to NIST, on the grounds that government purchasing could be an adoption driver.
I think that’s a cop-out. I don’t see any reason – commercial or technical – why an excellent distributed auditing standard couldn’t be developed quickly and adopted widely without resorting to government purchasing schedules and mandates. I can see lots of reasons why such a standard should be developed, the most important of which is that the standard would supply one of the key missing pieces of the compliance reporting puzzle.
There is some movement in the direction of such a standard. ArcSight has developed a proposed event record format called “Common Event Format” (CEF for short) and appears to want to standardize it. It’s a decent start, but it will need more work before it becomes the standard we need. Most notably, CEF defines only a record format; it doesn’t define service interfaces to allow event producers to notify event consumers that an event has been created and is ready to be processed. There are also technical deficiencies in the record format itself; it does not contain any mechanism for dealing with clock synchronization issues in distributed environments in which multiple systems are producing events. This omission makes CEF unsuitable for creating audit records which support forensic determination of the ordering of events which occur on different systems. Finally, CEF leaves the definition of event types (which are called “Signature IDs” in the specification, in a nod toward the intrusion-detection world) up to the individual event producers, thus inviting both ID conflict issues and proliferation of different names for events of the same type in different systems. You can get CEF from ArcSight here: http://www.arcsight.com/solutions_cef.htm.
MITRE is apparently starting an effort address some of the issues CEF leaves open through a standardization effort called “Common Event Expression” (CEE). This effort was announced on several blogs (including here: http://raffy.ch/blog/2007/04/19/standard-logging-format-common-event-exchange-cee/) in April. But no detailed information about CEE seems to have been published by MITRE yet.
In the meantime, an old standard I worked on all those years ago has been resurrected in not one but two places. At about the time X/Open and OSF merged to create The Open Group, a standard called “X/Open Distributed Audit Standard” (XDAS) was advanced to “preliminary” status. XDAS was a great piece of work; it addressed all the concerns necessary to build a robust distributed security auditing system in a mature and complete way. But it was a child of its time; it was an interface standard for C programs running on UNIX machines.
The Open Group moved on from X/Open’s mission of standardizing UNIX interfaces and OSF’s mission of building distributed system code which could be shared by many vendors, and XDAS got left behind.
But sometimes ideas are too good to die, and it seems that like King Arthur, XDAS was not dead but only sleeping. The Open Group Security Forum has recognized the need for an audit standard for the modern world, and is revising the specification to remove all the C and UNIX anachronisms and bring the functionality up to date. The landing page for this effort is here: http://www.opengroup.org/security/. And Novell, whose Bandit Project incorporates XDAS, has contributed source code to a new open-source project called OpenXDAS (http://openxdas.sourceforge.net/) which makes the XDAS implementation widely available.
Can XDAS be modernized? Can CEF be extended? What will CEE look like? Which of these efforts should you support? Or should you press NIST for a standard instead?
Frankly, I think you should support all of these options. We’ve been wandering in the audit desert for too long. Three standards would be infinitely better than none. One broadly agreed standard would be best of all – especially if that one standard exploited Web 2.0 information distribution channels like RSS. If we all start going to the meetings, my bet is that the existing efforts will converge pretty quickly on something well-integrated into the Web 2.0 architecture which is lighter than XDAS, more functional than CEF, and more broadly supported than either; this should be the goal.
I’m putting my money (or at least my time) where my mouth is here. I’ll be at the Open Group Security Forum meeting in Austin next week, working on XDAS again for the first time in a decade. I’ll let you know how it goes.
What about Common Base Events / Web Services
Distributed Management Event Format? Is it just IBM over-engineering or is there something more of substance that vendors can use?
Posted by: Ian Glazer | July 20, 2007 at 11:00 AM