ASSET SECURITY

Secure Configuration Using OSCAL

BloSS@M provides a capability for capturing and communicating security configuration details and implemented security controls for software assets in a standardized, machine-readable format. Through this capability, software vendors and other asset providers can formally describe the security protections incorporated into their products and demonstrate alignment with relevant regulatory, policy, and compliance requirements.

To facilitate interoperability and automation, BloSS@M leverages the OSCAL Component Definition model, which serves as a structured mechanism for expressing the security properities of reusable system components, including software products and services. The model enables providers to document implemented controls, security capabilities, and other characteristics relevant to risk management and compliance activities.

Beyond identifying implemented safeguards, OSCAL Component Definitions can also capture secure deployment and configuration guidance. These specifications define configuration settings and operational considerations required to achieve particular security and privacy objectives. By consuming this standardized information, organizations can more effectively integrate vendor-supplied security data into automated assessment, authorization, and continuous compliance processes while ensuring a consistent interpretation of asset security requirements.

This section dives into more details about how the OSCAL Component Definition model is utilized with BloSS@M.

Operational Capabilities for Assets

BloSS@M supports the enterprise-level discovery and visibility of software assets that are available for use across participating organizations. The model enables the identification of software products based on defined functional, contractual, or policy-based criteria to provide users with a consolidated view of available software assets. This capability supports inventory accuracy and reduces fragmentation caused by decentralized procurement and asset tracking practices. Asset discovery is a capability that could be extended to firmware and hardware assets acquisition, should an entity build and operate a centralized government-wide BloSS@M-like non-software assets acquisition service.

Within BloSS@M, software license, subscription, and leasing costs supplied by publishers and vendors are maintained as part of the asset record and made accessible to authorized users. Associating financial information directly with software assets allows organizations to incorporate cost considerations into budgeting efforts, procurement strategies, and lifecycle management activities.

The availability of standardized cost data supports more effective evaluation of comparable software products by enabling consistent price comparisons across competing offerings. This, in turn, helps decision-makers identify cost-effective solutions while improving transparency and accountability in enterprise software providing a consolidated view of software-related expenditures across the organization.

An equivalent capability could be incorporated into a future hardware and firmware acquisition ecosystem. By capturing and exposing cost information for non-software assets, organizations would be able to compare similar hardware and firmware offerings using consistent financial criteria, while also strengthening enterprise-wide budgeting, investment planning, and fiscal governance.

BloSS@M enables the comparative analysis of software assets that provide similar functionality. Comparison criteria may include functional characteristics, licensing or leasing terms, cost, and security-relevant attributes. By normalizing this information across products and vendors, BloSS@M supports informed decision-making and promotes the reuse of approved software assets across agencies.

Asset Comparison is a capability that could also be extended to a centralized government-wide firmware and hardware acquisition service.

A centrally managed leasing approach is supported in BloSS@M, where software usage rights are allocated to authorized users and can be adjusted dynamically based on operational needs. This model allows licenses to be reassigned as demand shifts, improving overall utilization while limiting unnecessary or duplicate purchases. All leasing transactions and usage events are systematically captured, ensuring that activity remains traceable and auditable.

This leasing and traceability function enables comprehensive lifecycle management of software assets by integrating ISO/IEC 19770-2 software identification (SWID) tags with established governance and operational workflows. SWID tags provide structured, machine-readable identifiers that describe key attributes of software, including product identity, version, edition, patch status, and relationships between lifecycle events such as installation, update, and removal.

By leveraging this standardized metadata, BloSS@M can maintain continuous visibility into software deployment and usage across environments. It supports ongoing monitoring of license entitlement versus actual consumption, tracks changes in software installations, and helps confirm that updates and security patches are properly applied throughout the lifecycle of each asset.

Technical Capabilities for Assets

BloSS@M integrates security configuration and control implementation information using OSCAL Component Definition artifacts. These artifacts provide machine-readable descriptions of implemented security controls and related characteristics for software assets. This capability enables consistent representation and allows for the automated analysis of software security posture across products, platforms, and vendors.

Using the OSCAL Component Definition model, vendors can create artifacts that document cryptographic elements, provenance, implemented security controls, and known vulnerabilities for any software, firmware or hardware component. These OSCAL artifacts can then be linked to any chosen Bill of Material (BOM) using OSCAL's built-in extension mechanisms. In the context of a BloSS@M-like service for hardware and firmware assets acquisition, OSCAL Component Definition artifacts can also incorporate pointers to application-specific integrated circuit (ASIC) documentation.

BloSS@M maintains ongoing linkage between software assets and publicly documented vulnerabilities through integration with the NVD. The vulnerability data it uses includes details such as affected products, unique vulnerability IDs, and severity or impact scores. With this information, organizations can better understand their exposure, decide which issues to address first, and incorporate security risk into decisions about software procurement and lifecycle management. The Asset Vulnerability Identification function could also be expanded to support a centralized, government-wide service for acquiring firmware and hardware.

BloSS@M enables threat analysis by mapping the security attributes of software assets to adversary tactics, techniques, and procedures described in the MITRE ATT&CK framework. This type of threat overlay adds context on how software might be exploited or targeted in real-world environments, helping improve the quality of risk assessments and decision-making. The Asset Threat Overlay capability could likewise be broadened to support a centralized, government-wide system for acquiring firmware and hardware.

Building on standardized security models and the integration of vulnerability and threat intelligence, BloSS@M enables automated and AI-assisted preliminary security evaluations. In this context, a provisional security assessment is an early-stage determination of risk for a system component that has not yet been fully developed or deployed. It draws on initial testing of security controls, risk analysis, and OSCAL Component Definitions, while formal assessment and authorization are carried out later within the system's operational context.

These assessments make use of agentic and generative AI methods to evaluate documented security controls in structured formats such as OSCAL Component Definitions, and to relate identified threats and mitigations using frameworks like MITRE ATT&CK and D3FEND. The outputs are designed to support ongoing monitoring, comparative risk analysis, and informed decision-making, while still complementing established authorization and risk management processes.

Leveraging the National Vulnerability Database (NVD) for Asset Vulnerabilities

The ability to discover, map, and evaluate publicly disclosed software vulnerabilities plays a key role in both software asset management and supply chain risk management. Within the BloSS@M service, the asset vulnerability identification function brings structure to vulnerability data and provides automated access to trusted sources, helping maintain ongoing visibility into security risks associated with software.

BloSS@M incorporates the Common Vulnerabilities and Exposures (CVE) program and the National Vulnerability Database (NVD), along with automated mechanisms for retrieving their data. Together, these capabilities support scalable, up-to-date analysis of vulnerabilities across all managed software assets.

BloSS@M uses the CVE program and the NVD to identify and track publicly known software vulnerabilities in a consistent way. The CVE program assigns a unique ID to each vulnerability found in software, firmware, or hardware so it can be easily referenced across tools and organizations. It is maintained by MITRE and supported by DHS and CISA.

The NVD expands on CVE records by adding extra details like affected products, severity scores, impact information, and links to more resources. The Common Platform Enumeration (CPE) system provides a standard way to name software and hardware products so they can be matched more easily to vulnerabilities. Together, CVE, NVD, and CPE are part of the Security Content Automation Protocol (SCAP), which helps automate vulnerability management.

In BloSS@M, this data is used to connect software assets with known vulnerabilities in a clear, structured way. This supports automated risk tracking and helps manage security issues throughout the software lifecycle.

Automated Vulnerability Detection Using NVD Data

The NVD offers publicly available application programming interfaces (APIs) that allow automated access to vulnerability data. These APIs support structured searches using parameters such as CVE IDs, CPE names, vendors, products, and software versions. BloSS@M connects to the NVD APIs to automatically retrieve vulnerability information as needed for the software assets managed in the system.

The integration between BloSS@M and the NVD APIs is organized as a defined data flow:

Using OSCAL component definition artifacts, BloSS@M links registered software assets to key identifying details such as product name, version, and standardized CPE identifiers when they are available.

Using the asset metadata, BloSS@M builds queries for the NVD API with relevant search parameters, such as CPE names or CVE IDs, to obtain vulnerability records associated with the asset.

BloSS@M submits requests to NVD APIs using supported query mechanisms. These requests are executed on demand or as part of scheduled monitoring activities.

The NVD API returns data in a structured format that includes details such as CVE IDs, affected versions, severity scores (like CVSS), and reference links. BloSS@M then standardizes this information so it is represented consistently across different assets and vendors.

Retrieved vulnerability data is correlated with the corresponding software assets within BloSS@M to enable traceability between assets, vulnerabilities, and security information.

Associated vulnerability data is made available for comparative analysis, risk evaluation, and integration with other BloSS@M capabilities, including threat mapping, AI-assisted provisional assessments, and continuous authorization activities.

Leveraging MITRE ATT&CK and D3FEND for Software Asset Resilience Assessment

BloSS@M uses the MITRE ATT&CK and MITRE D3FEND frameworks to evaluate how well a software asset can resist known attacker behaviors. ATT&CK describes common attacker tactics and techniques, while D3FEND focuses on defensive methods that can help prevent, detect, or reduce those attacks.

The process starts by collecting security-related information about each software asset, including its controls and configurations. This information comes from sources like OSCAL Component Definition artifacts. BloSS@M then matches these controls to D3FEND techniques to show what defenses the asset has in place.

At the same time, BloSS@M uses ATT&CK to identify which attack techniques are relevant to the asset based on how it is used, where it is deployed, and any known vulnerabilities. Data from the NVD can also help highlight which attacks are more likely.