4.4b Security Tools: SCAP, Benchmarks, Compliance 10

SCAP (Security Content Automation Protocol)

NIST-maintained standard allowing diverse security tools (firewalls, IPS, scanners) to describe the same vulnerability using identical language, enabling automated cross-tool correlation and remediation.

Security benchmark

A compiled set of best-practice configuration settings for a specific OS, app, or platform, applied to harden it out of the box.

CIS (Center for Internet Security)

Organization maintaining an extensive library of security benchmarks at cisecurity.org.

Agent-based compliance check

Software permanently installed on a device, continuously verifying compliance. Always-on, but requires ongoing updates and maintenance.

Agentless compliance check

Runs on-demand, e.g. at login or VPN connection, executes in memory, checks compliance, then removes itself. No maintenance overhead, but not continuously running.

Agent-based vs agentless tradeoff

Agent-based: continuous coverage, needs upkeep. Agentless: no footprint, only checks at trigger points, not 24/7.

SIEM forensics reporting

Long-term log storage in a SIEM enables reconstructing events from historical data after an incident, not just real-time dashboards.

Antivirus / anti-malware

Detects malicious software: Trojans, worms, macro viruses, spyware, ransomware, fileless malware. Terms used interchangeably in modern practice.

Signature-based vs heuristic detection

Antivirus historically used signature matching for known viruses; anti-malware added broader behavioral/heuristic detection for newer threats. The distinction can still matter even though product names have merged.

DLP (Data Loss Prevention)

Monitors and blocks transmission of sensitive data such as SSNs, medical info, or credit card data in real time; deployable on endpoints, network appliances, or in the cloud.