Security assessment and threat response through SCAP

Managing the security of IT systems is becoming increasingly complex. As the number and variety of devices and their functionalities grows, so does the opportunities for attackers to successfully exploit vulnerabilities and infiltrate a system. Thus the need for the introduction of automatic processes and tools that can help security administrators in evaluating and maintaining the desired level of security. SCAP is a framework that provides a standard for the format and nomenclature of security-related information, and its components and reference data can be used to ensure consistency and interoperability between security automation tools. The objective of the thesis is to analyze SCAP both from a theoretical perspective, referencing the official documentation of the various standards, and from its actual implementations, presenting and testing the functionalities provided by the OpenSCAP suite of tools, referring in particular to the most relevant fields such as virtualized environments. Then the current gaps and limitations are discussed, pointing out which aspects of SCAP can be improved and where the biggest implementation gaps can be found. Lastly, some solutions are presented that can enhance functionalities and reduce gaps, ranging from the automatic remediation of container images, to the implementation of a continuous monitoring tool, to the integration of weaknesses and attack pattern recognition in the security automation process.