atsec's Cryptographic and Security Testing Laboratory Accredited for SCAP Testing by NIST's Computer Security Division and NVLAP

Business Wire, Feb 27, 2008

atsec information security Widens Its Scope of IT Security Services

AUSTIN, Texas -- atsec information security is proud to announce the successful accreditation of its cryptographic and security testing laboratory as a SCAP (Security Content Automation Protocol) test laboratory under the NVLAP (National Voluntary Laboratory Accreditation Program) supporting the Information Security Automation Program (ISAP); a U.S. government multi-agency initiative to enable automation and standardization of technical security operations. With this addition to the atsec IT security portfolio we will be able to test our customer's products against the SCAP standards using derived test requirements provided by the NIST Computer Security Division's Information Security Automation Program (ISAP) supported by the National Vulnerability Database (NVD) program.

Steve Weingart, Principal Consultant at atsec commented: "SCAP is a new standard that has been created to verify security configuration and vulnerability reporting, for computing systems and software. While the initial motivation is for government users to meet Federal requirements, we expect that the usefulness of this standard will promote its acceptance in industry and education as well."

The Security Content Automation Protocol (SCAP), pronounced "Ess-Cap", is a method for using specific standards to enable automated vulnerability management, measurement, and policy compliance evaluation (e.g., FISMA compliance). More specifically, SCAP is a suite of open standards that: enumerates software flaws, security related configuration issues, and product names; measures systems to determine the presence of vulnerabilities; and provides mechanisms to rank (score) the results of these measurements in order to evaluate the impact of the discovered security issues. SCAP defines how these standards are used in unison to accomplish these capabilities.

SCAP includes the following standards:

* Common Vulnerabilities and Exposures (CVE[R])

* Common Configuration Enumeration (CCE[TM])

* Common Platform Enumeration (CPE[TM])

* Common Vulnerability Scoring System (CVSS)

* eXtensible Configuration Checklist Description Format (XCCDF)

* Open Vulnerability and Assessment Language (OVAL[TM])

atsec has longstanding experience with IT security testing, evaluation and validation of software and hardware products. We are accredited as a Common Criteria Evaluation Laboratory, Cryptographic Module Testing Laboratory for FIPS 140-2.

For more information on The Information Security Automation Program and The Security Content Automation Protocol please visit http://nvd.nist.gov/scap.cfm.> About atsec information security

atsec information security is an independent, standards-based IT (information technology) security consulting and evaluation services company that combines a business-oriented approach to information security with in-depth technical knowledge and global experience. atsec was founded in Munich (Germany) in 2000 and has extensive international operations with offices in the U.S., Germany, Sweden and China. atsec leverages its deep security, process, and standards expertise to consult on a wide range of IT security needs, enabling clients to establish integrated security management procedures in order to manage security risk and improve data, product, and business process reliability. atsec works with leading global companies such as IBM, HP, Oracle, Cray, BMW, SGI, Vodafone, Swisscom, RWE, and Wincor-Nixdorf. For more information please visit www.atsec.com.