AUTOMATED AUDITING OF FUTURE-PROOF SECURITY STANDARDS OF BIG DATA-BASED SYSTEMS

This article is dedicated to SCAP (Security Content Automation Protocol) technology and relates to other important security standards that are an essential part of modern information security. SCAP is a set of standardized protocols and tools used to assess, monitor and report on the security state of an IT infrastructure. Big Data systems are also of particular importance in this context, as systems based on big data are increasingly used and the security of these systems plays a critical role. The paper examines the main components of SCAP, including the CVE, CCE, CPE and OVAL subprotocols, and analyzes their functionality. Practical uses of the SCAP tool such as vulnerability detection, configuration management and compliance testing are discussed. The application of these tools is especially important in Big Data systems, where the risks arising from the abundance and variety of data are increasing. The application of SCAP technology provides a useful tool for identifying vulnerabilities in these systems and taking appropriate action. SCAP’s compliance with international standards such as ISO 27001 is examined in detail. The paper discusses how SCAP can contribute to compliance with 27001 requirements, particularly in the areas of risk management, asset management and security controls. For Big Data systems, this compliance is even more important because security issues in these systems are not only related to data storage but also to data processing and transmission. It also highlights how SCAP can be integrated with other security frameworks such as the NIST Cybersecurity Framework and PCI DSS. As Big Data systems often run on cloud-based and distributed infrastructure, integrating SCAP with these frameworks allows for more secure systems by unifying various security protocols and rules. Keywords: SCAP (Security Content Automation Protocol), Big Data systems, International Security standards, CVE (Common Vulnerabilities and Exposures), Configuration Management, ISO 27001