NIST SP 800-128 – Because Patching May Never Fix Your Hidden Flaws

Over the last few years, the idea of patching systems to correct flaws has graduated from an annoying business disruption to a top priority. With all of the notorious vulnerabilities that can wreak total havoc, the time it takes to patch becomes a minor inconvenience when weighed against both the technical challenges and possible regulatory penalties of not patching. 

While patching is a critical component of a comprehensive security program, one area that is more challenging is configuration management. No matter how frequently a system is patched, it can all be undone by a misconfiguration or an overlooked configuration. This is especially true when working with security configurations. These hidden flaws in a system remain even with the most current and rigorous patching process.

Getting to Know NIST SP 800-128

Fortunately, there’s some guidance for configuration management specifically targeted towards security. NIST Special Publication 800-128, titled “Guide for Security-Focused Configuration Management of Information Systems,” presents advice that works in tandem with its parent guidance, the well-known SP 800-53 (now at Revision 5) “Security and Privacy Controls for Information Systems and Organizations.”

SP 800-128 was originally published in 2011, and it now contains updates from 2019. The comparisons between the two documents can be found in the eight-page Errata statement at the beginning of the publication; however, most of that is a collection of updated index references for other referenced documents. The main content begins after that and continues up until the appendices, which begin at page 46. (A note about the NIST appendices: Anyone who has ever read a NIST document knows that the appendices are equally as important as the body of the document and should not be overlooked. There are some really impressive flow charts in Appendix G that add visual clarity to the text of the full publication.)

The authors state very early in the publication how this guidance is different from standard configuration management:

Security-Focused Configuration Management (SecCM) is the management and control of secure configurations for a system to enable security and facilitate the management of risk. SecCM builds on the general concepts, processes, and activities of configuration management by attention on the implementation and maintenance of the established security requirements of the organization and systems.

Some key points within the document include the phases of security focused configuration management, controlling changes to security configurations and monitoring for changes. The phases of security configuration management resemble those of all mature security programs, working in a cycle that specifies planning, identifying, change control, monitoring and constant reevaluation of security configurations.

A major bulk of the document is spent describing steps that must be achieved during the planning phase. This is usually the part that makes many of the tech-focused infosec folks roll their eyes and grunt about how it is more important to “get the work done.” However, this is also the foundation which, if overlooked, could not only cause missteps in a robust SecCM implementation but also be the playbook that a keen auditor will use to show weaknesses in a security practice. Similar weaknesses in overall security have proven costly when examined by regulatory authorities. Can penalties for security misconfigurations be far behind?

The entirety of SP 800-128 is about process, not prescriptive technical advice. The authors are well-aware that there are too many possible combinations to make any specific recommendations. In fact, they clearly and eloquently restate the mantra that there is no “One Size Fits All” approach to security configuration management:

Implementing secure configurations for IT products is no simple task. There are many IT products, and each has a myriad of possible parameters that can be configured. In addition, organizations have mission and business process needs which may require that IT products be configured in a particular manner. To further complicate matters, for some products, the configuration settings of the underlying platform may need to be modified to allow for the functionality required for mission accomplishment such that they deviate from the approved common secure configurations.

If you are a technical wizard who is tasked with ensuring the security of your organization’s systems, it would be wise to spend some quality time with SP 800-128. Not only will it make you better prepared, but it will also help you to work along with the project managers, auditors and security managers to keep all the important parts of SecCM in order.

To learn more about the benefits of SCM, download Tripwire’s latest eBook “Mastering Configuration Management Across the Modern Enterprise: An Explorer’s Guide to SCM.”

Editor’s Note: The opinions expressed in this guest author article are solely those of the contributor, and do not necessarily reflect those of Tripwire, Inc.