SPECS: Security Policy Enforcement and Compliance System

21st Century Technologies presents this Phase II SBIR effort, entitled: Security Policy Enforcement and Compliance System (SPECS). SPECS is a framework for managing security policy on super-sized, diverse and dynamic networks. SPECS automates policy management by encoding policies in an ontology to facilitate automated enforcement given operational requirements. By linking policies to the controls that enforce them, SPECS can rapidly deploy existing policies into new or changing operational environments, and it can update existing environments in response to changes in the policies themselves. This end-to-end modeling also enables SPECS to quickly assess compliance for assured levels of network security. Building on the foundation of the Phase I effort, the SPECS Phase II effort will focus on the domain of information security policy management. Through discussion with subject matter experts, 21CT has recognized that a technology to provide automated information security policy management has extraordinary marketability not only within the DoD, but commercially to companies of all levels, from small business to multi-national corporations. Despite this focus, the SPECS solution is designed to cover many aspects of computer security.