One of the fun things about working for Digital Bond is that we get to share some of our back-end conversations and thought processes here on the blog when we feel they will be of benefit. We recently had one of those discussions regarding terminology for the Bandolier project.  It started something like this:

Dale: So I noticed you referred to the Bandolier deliverables as templates – so are they audit files or audit templates?

Me: I thought I heard you calling them audit templates, so I just picked it up and ran with it.

And in a quick review of my last Bandolier blog, sure enough, I repeatedly called them audit templates. We decided that we should choose a term for consistency but it wasn’t as cut and dry as you might think.

The Argument for Audit Template
From the beginning of the project, we have discussed the need and opportunity for customization of the Bandolier files. For example, the file will include some checks for password policy. Your local security policy, however, may dictate a more stringent set of requirements. You could easily customize the file to match those requirements. From this standpoint, you could make the argument that the file is really designed for local customization, and therefore is a more of an “audit template”.

Right now we are focused on developing the files for the Nessus policy compliance plugin. (Incidentally, Tenable uses the term “audit policies”) Later in the project, though, we will generalize the files for other scanners and tools using OVAL/XCCDF. Because they will be expanded in this manner may be another argument for the term “audit template”.

The Argument for Audit File
File is a generic term that is hard to get away from. I noticed, in fact, that I used it six times while writing the previous section. Each Bandolier deliverable does exist in a file. For Nessus, it exists in .audit file, and in its OVAL/XCCDF form, it will also  exist in a file. “Audit file”, then, certainly seems to cover the bases.

The final argument for “audit file”, and probably the clincher, is that we may want to reserve the term “audit template” for a subsequent extension of the Bandolier project. We may create some checklists based on all the control system application assessments we have completed, for example. Or there could be other project extensions that make better use of the term “audit template”.

In the end, we chose the term “audit file” for the Bandolier deliverables. So please forgive us for some past use of “audit template” and stay tuned for an announcement regarding the first of those audit files that will be available in mid-July.