The State of Security Automation Standards - 2011

Security automation standards sponsored by the U.S. Government have evolved significantly in the decade since MITRE created and released the Common Vulnerabilities and Exposures (CVE) dictionary. There are now more than two dozen individual standards in use or under development supporting a wide range of security information and functionality. These standards are supported by a variety of sponsors and governance models as well as an ever-growing community of developers, implementers, and users. Reflective of a growing community, the attendance at NIST's Security Automation Conference has continued to grow over the past several years. The more mature of the standards have been incorporated into hundreds of tools and CVE has become virtually ubiquitous in its subject area. Given the ever-increasing community of adopters, implementers, and contributors, it is clear that the overall security automation effort has been highly successful thus far, and its capabilities and interest in those capabilities continue to grow. This paper seeks to provide an overview of all the components in security automation as of August 2011.