Automatically scores how well Windows systems have implemented some of the top 10 Information Assurance mitigation strategies. #nsacyber
Mitigation implementations have not traditionally been evaluated or prioritized. NSA Information Assurance recommends mitigation strategies but there are few methods to validate proper implementation and prioritize fixes. The SAMI application was developed to monitor the degree to which specific aspects of the NSA Information Assurance top 10 mitigation strategies have been deployed on Windows endpoints. It monitors data related to the implementation of specific mitigations and returns prioritized recommendations to more completely implement those recommendations. The application can be used to determine a network’s mitigation implementation status and can be monitored over time to demonstrate improvements and identify changes that negatively impact mitigations.
SAMI evaluates several metrics:
The application aims to make automated measurement of mitigations both common and understandable. More specifically, the goals for SAMI are to:
There are two main components:
These components are available as Splunk applications and can be downloaded from Splunkbase:
The source code for the binary components (ae.exe and av.exe) in SAMI-TA are available in the LOCKLEVEL repository.
Documentation available for SAMI:
A session about SAMI was given at Splunk .conf2015:
See LICENSE.
See DISCLAIMER.