Introduction to OVAL: A new language to determine the presence of software vulnerabilities

Size: px
Start display at page:

Download "Introduction to OVAL: A new language to determine the presence of software vulnerabilities"

Transcription

1 Introduction to OVAL: A new language to determine the presence of software vulnerabilities Matthew Wojcik / Tiffany Bergeron / Robert Roberge November 2003 The MITRE Corporation

2 Table of Contents Introduction 1 Open Vulnerability Assessment Language (OVAL) 1 An OVAL-Enabled Process 2 Improving Vulnerability Assessment with OVAL 2 System Administrators and Other End Users 3 Software and Tool Vendors 3 Community Involvement and Support 4 An OVAL Board of Industry, Academia, and Government Organizations 4 Broad Industry Participation via the OVAL Community Forum 5 A Community-Developed OVAL Schema 5 Creating OVAL Queries 5 Reference Query Interpreter 7 How the Query Interpreter Works 7 OVAL Query Syntax Checker 8 Other Implementations and Uses of OVAL Actively Encouraged 8 Value of OVAL's CVE-Compatibility 8 MITRE's Role 9 Summary of OVAL Benefits 10 Conclusion 10 iii

3 Introduction to OVAL: A new language to determine the presence of software vulnerabilities Matthew Wojcik / Tiffany Bergeron / Todd Wittbold / Robert Roberge The MITRE Corporation Introduction As recently as 2002, there was no structured means for network and system administrators to determine in a definitive way if software vulnerabilities existed on their local computer systems. This was a major concern for organizations of all types and sizes, as vulnerabilities are the entry points for hackers and if not fixed may result in significant recovery expenses if a compromise occurs. Although some of the required information was and remains available as text-based vulnerability descriptions from vulnerability knowledge sources such as software and tool vendors, government agencies, and security consulting firms, it is a labor-intensive and errorprone process for system administrators to read and interpret this unstructured information and then make an accurate determination that a vulnerability truly exists on the system. This paper outlines MITRE s Open Vulnerability Assessment Language (OVAL ) concept, an information security community effort that solves this problem by using SQL queries to create "gold standard" tests that definitively determine the presence of vulnerabilities on end systems. Open Vulnerability Assessment Language (OVAL) OVAL is the common language for security experts to discuss and agree upon technical details about how to check for the presence of vulnerabilities on a computer system. The end results of the discussions are OVAL queries, which perform the checks to identify the vulnerabilities. OVAL queries are written in SQL and use a collaboratively developed and standardized SQL schema as the basis for each query. SQL stands for Structured Query Language, the industry standard database language that is widely understood by numerous computer professionals. OVAL queries detect the presence of software vulnerabilities in terms of system characteristics and configuration information, without requiring software exploit code. By specifying logical conditions on the values of system characteristics and configuration attributes, OVAL queries characterize exactly which systems are susceptible to a given vulnerability. System characteristics include operating system (OS) installed, settings in the OS, software applications installed, and settings in applications, while configuration attributes include registry key settings, file system attributes, and configuration files. OVAL queries are based primarily on the known vulnerabilities identified in Common Vulnerabilities and Exposures (CVE ), a dictionary of standardized names and descriptions for publicly known information security vulnerabilities and exposures developed by The MITRE Corporation in cooperation with the international security community (http://cve.mitre.org). CVE common names make it easier to share data across separate network security databases and tools that are CVE-compatible. CVE also provides a baseline Open Vulnerability Assessment Language 1

4 for evaluating the coverage of an organization's security tools, including the security advisories it receives. For each CVE name, there are one or more OVAL queries. The official common OVAL Schema is the framework on which OVAL queries are based. It was approved by the OVAL Board, which includes representatives from a broad spectrum of industry, academia, and government organizations. At the time of this writing, OVAL's initially supported platforms are: Microsoft Windows 2000; Microsoft Windows NT 4.0; and Sun Solaris 7, 8, and 9. Draft and not-yet-approved schema for Red Hat Linux, Debian Linux, Microsoft Windows XP, Microsoft Server 2003, and Hewlett-Packard UNIX (HP-UX) are also included. An OVAL-Enabled Process First, an OVAL-compliant assessment or scanning tool determines which vulnerabilities exist on your system and issues reports. (You may also use the OVAL queries themselves to perform this function manually.) Based upon these reports, you may then obtain appropriate software patches and fix information for remediation from the security assessment tools, your vendors, or vulnerability research databases and Web sites, and make the repairs. This process enables a consistent and repeatable approach for vulnerability assessment, leading to a more secure system. See figure 1. Figure 1. How OVAL leads to a more secure system Improving Vulnerability Assessment with OVAL The OVAL effort aims to provide a baseline method for performing vulnerability assessments on local computer systems. CVE has already improved the process by establishing a common name for each vulnerability or exposure so that security assessment tools are checking for the same issue. However, the ways in which the various tools perform the checks are different for each tool. If a computer is compared to a building and a vulnerability a way to get into the building, one tool checks for a door and declares its very existence a vulnerability. Another Open Vulnerability Assessment Language 2

5 tool checks to see if the door exists but also whether it is open or closed before declaring it a vulnerability. And yet another tool looks for large windows as well as doors. These differences make it especially difficult to make a truly definitive determination of whether or not a vulnerability is present. See figure 2. Figure 2. Tools check for vulnerabilities in different ways, making a definitive vulnerability determination difficult System Administrators and Other End Users The current process of vulnerability assessment is labor-intensive and error-prone. Much of the information required to verify that a vulnerability exists can be found as text-based descriptions from vulnerability knowledge sources such as the tool and software vendors themselves, government agencies, and security consulting firms. However, you must then assemble, read, and interpret this unstructured information to make the determination of whether or not the vulnerability actually does exist on the system. OVAL solves this problem. OVAL queries, which can be read manually or incorporated into vulnerability assessment tools, provide a collaboratively developed baseline check. Until OVAL, consistency in this capability did not exist. The widespread availability of OVAL queries will eventually provide the means for standardized vulnerability assessment. It will also result in consistent and reproducible information assurance metrics from your systems. Since OVAL queries express security problems in a language familiar to system administrators, they will have a concrete and actionable impact on your security remediation efforts. Software and Tool Vendors For operating system and application software vendors, the precise definitions of how to detect vulnerabilities found in OVAL queries eliminates the need for exploit code as an assessment tool. For tool vendors, there is no way to ensure customers are using your tools properly. The tests you implement to check for the vulnerabilities are frequently closed and proprietary, and are often in procedural code that is not easily read or understood by your customers, creating further usage difficulties. OVAL addresses these problems. Tools for collecting configuration information can be combined with OVAL language content to provide a baseline vulnerability assessment capability, resulting in more accurate determinations of existence for your customers and Open Vulnerability Assessment Language 3

6 fewer false positives than what currently exists today. The SQL on which OVAL queries are based can be easily converted into your tool's proprietary code or language. It will also allow your customers to compare the coverage of your OVAL-compliant tool using percentage of vulnerabilities found. Community Involvement and Support Community involvement is an integral component of the OVAL effort. OVAL is industryendorsed via the OVAL Board and OVAL Community Forum, ensuring that the OVAL Schema and all OVAL queries reflect the combined expertise of the broadest possible group of security and system administration professionals. An OVAL Board of Industry, Academia, and Government Organizations The OVAL Board includes members from major operating system vendors, commercial information security tool vendors, academia, government agencies, and research institutions (see Table 1). Other information security experts will be invited to participate on the Board on an as-needed basis based upon recommendations from Board members. The MITRE Corporation maintains OVAL and provides impartial technical guidance to the OVAL Board on all matters related to the ongoing development of OVAL. Archives of Board meetings and discussions are available for review and comment on the OVAL Web site. Table 1. OVAL Board Member Organizations Academic/Educational CERIAS/Purdue University Information Providers SANS Institute Operating System/Software Vendors Debian IBM Microsoft Red Hat Other Security Experts Bastille Linux Center for Internet Security CERT/CC (Software Engineering Institute, Carnegie Mellon University) Defense Information Systems Agency (DISA) National Security Agency (NSA) MITRE Corporation Tool Vendors BindView Corporation Cisco Systems Citadel Security Software Harris Corporation Internet Security Systems Symantec Open Vulnerability Assessment Language 4

7 Broad Industry Participation via the OVAL Community Forum The OVAL Community Forum List is a public forum for discussing the OVAL Schema, the OVAL queries posted on the OVAL Web site, and the information security vulnerabilities themselves that affect query writing. An archive of discussions is available for review. System administrators, software vendors, security analysts, tool developers, and other members of the information security community are actively invited to join the Forum on the OVAL Web site and at industry conferences and other events. Benefits of the OVAL Community Forum: Personal and organizational participation in a security community effort Opportunity to discuss and debate Initial Submission, Draft, Interim, and Accepted queries with other security and system administration professionals Assist in the development of the official OVAL Schema for the OSs of your choice Up-to-date, breaking information on the Initial Submission, Draft, Interim, and Accepted queries posted on the OVAL Web site An easy-to-use, lightly-moderated discussion list Easy reference and review of Forum Discussion Archives OVAL queries that reflect the insights and combined expertise of the broadest possible collection of security professionals A Community-Developed OVAL Schema The official OVAL Schema is a standard, common schema approved by the OVAL Board to serve as the language framework for writing OVAL queries. MITRE chose SQL as the framework because it allows a wide range of computer security professionals to discuss vulnerabilities in technical detail. The declarative nature of SQL brings focus to the logic of presence or absence of a vulnerability on a local system. Because they are written in SQL, OVAL queries are machine readable and can be used as part of host-based vulnerability assessment computer programs, or read in hardcopy or electronic form by information security professionals such as system administrators, security analysts, etc. For tool vendors, SQL is a specification and not an implementation requirement. The SQL information in OVAL can be converted into whatever implementation structure or format necessary for your tool. There is an official schema for each of the operating systems supported, which as of this writing includes: Windows 2000; Windows NT 4.0; and Solaris 7, 8, and 9. Also included are draft schemas for Red Hat Linux, Debian Linux, Windows XP, Microsoft Server 2003, and HP-UX. OVAL's standardized schema allows a wide range of computer security professionals to discuss the technical details of determining whether a vulnerability is present on a system. In addition, tool vendors or developers of security software may download the schema as input for OVAL-compliant scanning and assessment tools. Creating OVAL Queries Draft queries for CVE entries or configuration issues not yet included in CVE are written by MITRE, members of the OVAL Board, or other members of the information security Open Vulnerability Assessment Language 5

8 community and submitted to MITRE for public comment and review. Public comments on the drafts are made on the OVAL Community Forum, the public list created by MITRE for discussing the queries and the vulnerabilities on which they are based. Each individual OVAL query includes metadata, a high-level summary, and the detailed query. Query metadata provides the OVAL-ID, status of the query (Initial Submission, Draft, Interim, or Accepted), the version of the official OVAL Schema the query works with, the CVE name or candidate number, and a brief description of the security issue covered in the query. The high-level summary includes two sections: "Vulnerable software exists," which states the specific OS, the name of the file with the vulnerability in it, application version, and patch status; and "Vulnerable configuration," which indicates if the service is running or not, specific configuration settings, and workarounds. The detailed portion of queries includes the CVE name on which the query (or queries) is based, and provides the logic for checking for the system characteristics (OS installed, settings in the OS, software applications installed, and settings in applications) to indicate that vulnerable software exists, and configuration attributes (registry key values, file system attributes, and configuration files) to indicate that a vulnerable configuration exists. Once Community Forum discussion about an Initial Submission query has subsided, MITRE and the OVAL Board review and refine the queries, and then the queries are posted on the OVAL Queries page with a status of "Draft." Review and discussion continue as the query moves to "Interim," and finally to "Accepted" status (see Figure 3). Figure 3. Stages of an OVAL Query Queries may still need to be modified over time. For example, changes may be made when more information is learned about a vulnerability, vendor patches and service packs are released, or because of other factors not known when the queries were originally accepted. Public discussions for all Draft, Interim, and Accepted OVAL queries will always be ongoing. Open Vulnerability Assessment Language 6

9 Reference Query Interpreter Demonstrating the effectiveness of OVAL was an important first step of the OVAL effort. To do this, MITRE created a reference implementation of an "OVAL Query Interpreter" (QI) that shows how information can be collected and used to evaluate OVAL queries. MITRE developed the QI specifically to demonstrate the usability of OVAL queries, and to help query writers ensure correct syntax and adherence to the OVAL Schema during the development of draft queries. While it is effective, the QI is not a fully functional scanning tool and has a simplistic user interface, but running it will display a list of CVE entries determined by OVAL to be present on the system. How the Query Interpreter Works QI evaluates OVAL queries by (1) instantiating the OVAL Schema in an SQLite database; (2) populating this schema by collecting information about registry keys, process information, etc.; (3) evaluating the queries against the schema; and (4) providing a list of the CVE identifiers determined by OVAL to be present on the system. Step 1: To run QI, open a command window in the system s installation directory (QI is a command-line utility) and enter the MD5 hash/checksum from the OVAL Web site. This verifies that the data file being used is the same as the one currently available on the site. MITRE uses MD5 hash/checksum verification to ensure that installation program and data files for QI have not been modified in any manner. Once verification has been completed, QI builds an empty database and creates the tables as defined in the OVAL Schema for that platform. SQLite (http://www.sqlite.org/), an embedded freeware database engine that reads and writes directly to a file on the disk. The small size and ease of use made SQLite the best choice for QI. Step 2: After creating the empty tables, QI then collects the system configuration data. It is this information that will be used against the OVAL queries in Step 3. Depending upon the data being collected, QI may or may not collect all the information from the system. For example, data for a Process Table (i.e., process ID, command line of the executable, etc.) would be simple to collect while data for a File Attributes Table (i.e., owner, file size, etc.) or Registry Keys (i.e., entry value, type, etc.) would be more complex because of the sheer volume of that type of information. To address this problem, OVAL uses "Insert Statements" that are freely provided on the OVAL Web site for review or download along with the OVAL queries and which together are part of our regularly updated QI Data Files. Insert Statements identify the "certain files" and "certain registry keys" that the queries will need to execute properly; once read by QI, they direct the SQLite database to collect only that specific data. For example, an Insert Statement may specify the path name of a file so that QI will know to look up the version of only that file. Open Vulnerability Assessment Language 7

10 Step 3: Once the data has been collected and stored in the SQLite database, QI reads the OVAL queries from the Data Files then compares them against the system configuration data stored in the SQLite database. Step 4: If an OVAL query determines that a vulnerability is present on the system, QI displays onscreen the OVAL-ID of the query and CVE name that the particular query addresses. A list of OVAL-IDs/CVE names will be displayed if one or more vulnerabilities are found to be present. In addition to this list of "Vulnerabilities Found," QI will also display a list of the OVAL-IDs of the "Vulnerabilities Not Found." This second list, when combined with the results from the first, allow users to identify all of the queries that have been run against their system. QI can also display an informational "Errors" list of software patches and other information that the OVAL queries were looking for and could not locate. For example, when a particular application or software component is not installed on the system the Insert Statements cannot find the specified "certain files" and "certain registry keys" for which they are looking. Since installed patches are often determined by the existence of particular registry keys, if a patch is not installed then the registry key will obviously not exist. It is in this way that QI can determine if a patch is or is not installed. As with the "Vulnerabilities Found" list and the "Vulnerabilities Not Found" list, this information can be displayed onscreen on QI's simplistic user interface but users will need to run the specific command line option for printing all information and error messages to view it. OVAL Query Syntax Checker QI can also be used by query writers to ensure correct syntax during the development of draft queries and for adherence to the OVAL Schema. To use QI in this manner, you must choose the option for running the interpreter without requiring the MD5 checksum/hash at the command line. Running the interpreter with this option disables the important checksum verification security feature. However, it does allow you to test your draft queries with the interpreter before submitting them to the OVAL Community Forum for public review. Complete instructions for using QI are included in the Read Me file, which is posted on the OVAL Web site and included in the interpreter download. Other Implementations and Uses of OVAL Actively Encouraged MITRE's Reference Query Interpreter is, of course, only one implementation of OVAL. Numerous other uses and implementations are possible, and we strongly encourage tool developers and others to create them. Towards that end, all OVAL vulnerability content is freely available on the OVAL Web site, as are the OVAL Reference Query Interpreter itself and its source code. Finally, in addition to the OVAL Community Forum for query development, we also offer an discussion list specifically for developers dedicated to OVAL implementation issues. Sign-up is available for both lists on the OVAL Web site. Open Vulnerability Assessment Language 8

11 Value of OVAL's CVE-Compatibility The OVAL Web site is "CVE-compatible," which means that it uses CVE names in a manner that allows it to be cross-referenced with other Web sites, tools, databases, and other security products or services that also employ CVE names. All OVAL queries are based on the publicly known vulnerabilities identified in the CVE List, including both official CVE entries and CVE candidates. Official CVE entries (also referred to as a CVE "name") include the name, a brief description of the security vulnerability or exposure, and any pertinent references. Candidates, or "CANs," are assigned special numbers to distinguish them from CVE entries, but as with official entries each candidate includes a description of the issue and references. If a candidate defined by an OVAL query becomes an official CVE entry, the candidate number will be replaced with the official CVE name in all OVAL queries. When a new CVE version is released, all changes to CVE candidate and entry names included on the OVAL Web site are updated. System administrators can take advantage of OVAL's CVE compatibility by searching the queries posted on the OVAL Web site by a specific CVE entry or CVE candidate number. You can then use the query to see if your system has that vulnerability, or to verify that an OVALcompliant scanner has truly discovered the problem. OVAL's CVE compatibility also means tool vendors can immediately identify the queries they need to incorporate into their proprietary tools by the CVE or the CAN, and software vendors can include the OVAL-ID number along with the CVE or CAN in their product alerts. Tool and software vendors are also encouraged to submit draft queries for their own products and services. MITRE's Role MITRE developed the OVAL concept, created the OVAL Board, maintains OVAL with assistance from the Board, moderates the OVAL Community Forum List, manages the evolution of all OVAL queries and the ongoing work of the OVAL Web site, and provides neutral guidance throughout the process to ensure that OVAL serves the public interest. In partnership with government clients, The MITRE Corporation (MITRE) is a not-for-profit corporation working in the public interest. It addresses issues of critical national importance, combining systems engineering and information technology to develop innovative solutions that make a difference. MITRE's work is focused within three Federally Funded Research and Development Centers (FFRDCs). One FFRDC performs systems engineering and integration work for Department of Defense C3I. A second performs systems research and development work for the Federal Aviation Administration and other civil aviation authorities. The third FFRDC provides strategic, technical and program management advice to the Internal Revenue Service and the Treasury Department. In accordance with its mission, MITRE has traditionally acted in the public interest. Its unique role allows it to provide an objective perspective to this community effort. MITRE will maintain OVAL as long as it serves the community to do so. Open Vulnerability Assessment Language 9

12 Summary of OVAL Benefits A simple and straightforward way to determine if a vulnerability exists on a given system A standard, common schema of security-relevant configuration information For each CVE entry, one or more SQL queries precisely demonstrate that the vulnerability exists Reduces need for disclosure of exploit code as an assessment tool An open alternative to closed, proprietary, and replicated efforts A community effort of security experts, system administrators, software developers, and other experts Freely available vulnerability content for public review, comment, or download from the Internet Industry-endorsed via the OVAL Board and OVAL Community Forum Conclusion The OVAL effort will continue to grow as organizations adopt tools that use OVAL as well as encourage their vendors to incorporate OVAL into their products and services. Ongoing community participation in query development is also important. System administrators, software vendors, security analysts, developers, and other members of the information security community are encouraged to join the OVAL Community Forum at to submit new queries, as well as to discuss and debate the queries currently posted on the OVAL Web site (http://oval.mitre.org) The MITRE Corporation. All rights reserved. Open Vulnerability Assessment Language 10

A Vulnerability Assessment Tool based on OVAL in Linux System

A Vulnerability Assessment Tool based on OVAL in Linux System A Vulnerability Assessment Tool based on OVAL in Linux System Youngmi Kwon 1, Hui Jae Lee 2, Geuk Lee 3 1 Dept. of InfoCom, Chungnam National University, Daejeon, South Korea ymkwon@cnu.ac.kr 2 Dept. of

More information

Status Update. Jon Baker September 28, 2010

Status Update. Jon Baker September 28, 2010 Status Update Jon Baker September 28, 2010 HS SEDI is a trademark of the U.S. Department of Homeland Security (DHS). OVAL Overview An international, information security, community standard to promote

More information

STAT Scanner Product Guide

STAT Scanner Product Guide STAT Scanner Product Guide Introduction to STAT Scanner The Importance of a Healthy Computer Newspaper headlines contain almost daily reports on companies that have lost substantial time and money from

More information

NCIRC Security Tools NIAPC Submission Summary Harris STAT Scanner

NCIRC Security Tools NIAPC Submission Summary Harris STAT Scanner NCIRC Security Tools NIAPC Submission Summary Harris STAT Scanner Document Reference: Security Tools Internal NIAPC Submission NIAPC Category: Vulnerability Scanning Date Approved for Submission: 24-04-2007

More information

Transformational Vulnerability Management Through Standards. Robert A. Martin MITRE Corporation

Transformational Vulnerability Management Through Standards. Robert A. Martin MITRE Corporation Transformational Vulnerability Management Through Standards Robert A. Martin MITRE Corporation The Department of Defense s new enterprise licenses for vulnerability assessment and remediation tools [1,2]

More information

Open Vulnerability and Assessment Language (OVAL ) Validation Program Test Requirements (DRAFT)

Open Vulnerability and Assessment Language (OVAL ) Validation Program Test Requirements (DRAFT) NIST Interagency Report 7669(Draft) Open Vulnerability and Assessment Language (OVAL ) Validation Program Test Requirements (DRAFT) John Banghart Stephen Quinn David Waltermire NIST Interagency Report

More information

The following text was provided by the vendor during testing to describe how the product implements the specific capabilities.

The following text was provided by the vendor during testing to describe how the product implements the specific capabilities. Vendor Provided Validation Details - McAfee Policy Auditor 6.2 The following text was provided by the vendor during testing to describe how the product implements the specific capabilities. Statement of

More information

Making Vulnerability Management Operational

Making Vulnerability Management Operational QuickTime and a TIFF (Uncompressed) decompressor are needed to see this picture. Making Vulnerability Management Operational Track 1 11:45am-12:30pm/Ballroom A Robert A. Martin The MITRE Corporation Preview

More information

Sygate Secure Enterprise and Alcatel

Sygate Secure Enterprise and Alcatel Sygate Secure Enterprise and Alcatel Sygate Secure Enterprise eliminates the damage or loss of information, cost of recovery, and regulatory violation due to rogue corporate computers, applications, and

More information

Security Content Automation Protocol for Governance, Risk, Compliance, and Audit

Security Content Automation Protocol for Governance, Risk, Compliance, and Audit UNCLASSIFIED Security Content Automation Protocol for Governance, Risk, Compliance, and Audit presented by: Tim Grance The National Institute of Standards and Technology UNCLASSIFIED Agenda NIST s IT Security

More information

IBM Tivoli Endpoint Manager for Security and Compliance

IBM Tivoli Endpoint Manager for Security and Compliance IBM Endpoint Manager for Security and Compliance A single solution for managing endpoint security across the organization Highlights Provide up-to-date visibility and control from a single management console

More information

eeye Digital Security Product Training

eeye Digital Security Product Training eeye Digital Security Product Training Retina CS for System Administration (4MD) This hands-on instructor led course provides security system administration/analysts with the skills and knowledge necessary

More information

Secstate: Flexible Lockdown, Auditing, and Remediation

Secstate: Flexible Lockdown, Auditing, and Remediation Secstate: Flexible Lockdown, Auditing, and Remediation Certifiable Linux Integration Project Tresys Technology Karl MacMillan Topics Secstate Overview Sample session illustrating

More information

TECHNICAL NOTE 08/04 IINTRODUCTION TO VULNERABILITY ASSESSMENT TOOLS

TECHNICAL NOTE 08/04 IINTRODUCTION TO VULNERABILITY ASSESSMENT TOOLS TECHNICAL NOTE 08/04 IINTRODUCTION TO VULNERABILITY ASSESSMENT TOOLS 1 OCTOBER 2004 This paper was previously published by the National Infrastructure Security Co-ordination Centre (NISCC) a predecessor

More information

BladeLogic Software-as-a- Service (SaaS) Solution. Help reduce operating cost, improve security compliance, strengthen cybersecurity posture

BladeLogic Software-as-a- Service (SaaS) Solution. Help reduce operating cost, improve security compliance, strengthen cybersecurity posture BladeLogic Software-as-a- Service (SaaS) Solution Help reduce operating cost, improve security compliance, strengthen cybersecurity posture February 20, 2014 Contents The Configuration Security Compliance

More information

Federal Desktop Core Configuration (FDCC)

Federal Desktop Core Configuration (FDCC) Federal Desktop Core Configuration (FDCC) Presented by: Saji Ranasinghe Date: October, 2007 FDCC Federal Desktop Core Configuration (FDCC) Standardized Configuration with Hardened Security Settings to

More information

Common Platform Enumeration (CPE) Technical Use Case Analysis

Common Platform Enumeration (CPE) Technical Use Case Analysis Common Platform Enumeration (CPE) Technical Use Case Analysis The MITRE Corporation November, 2008 Executive Summary A common theme taken from discussions at the Common Platform Enumeration (CPE) Developer

More information

OVAL Developer Days. July 11-12, 2006

OVAL Developer Days. July 11-12, 2006 OVAL Developer Days July 11-12, 2006 Introduction...- 3 - Attendee List...- 4 - Day One...- 5 - Session 1...- 5 - OVAL Tutorial... - 5 - Session 2...- 5 - External Repositories... - 5 - Inventory Definitions...

More information

Host Hardening. Presented by. Douglas Couch & Nathan Heck Security Analysts for ITaP 1

Host Hardening. Presented by. Douglas Couch & Nathan Heck Security Analysts for ITaP 1 Host Hardening Presented by Douglas Couch & Nathan Heck Security Analysts for ITaP 1 Background National Institute of Standards and Technology Draft Guide to General Server Security SP800-123 Server A

More information

Complete Patch Management

Complete Patch Management Complete Management Targeted, Reliable and Cost-efficient In- Depth CSI Corporate Software Inspector Empower your IT-Operations and Security Teams with the most reliable Vulnerability & Management solution

More information

Idera SQL Diagnostic Manager Management Pack Guide for System Center Operations Manager. Install Guide. Idera Inc., Published: April 2013

Idera SQL Diagnostic Manager Management Pack Guide for System Center Operations Manager. Install Guide. Idera Inc., Published: April 2013 Idera SQL Diagnostic Manager Management Pack Guide for System Center Operations Manager Install Guide Idera Inc., Published: April 2013 Contents Introduction to the Idera SQL Diagnostic Manager Management

More information

Secure Content Automation Protocol (SCAP): How it is increasingly used to automate enterprise security management activities

Secure Content Automation Protocol (SCAP): How it is increasingly used to automate enterprise security management activities Secure Content Automation Protocol (SCAP): How it is increasingly used to automate enterprise security management activities Sean Barnum sbarnum@mitre.org September 2011 Overview What is SCAP? Why SCAP?

More information

GFI White Paper PCI-DSS compliance and GFI Software products

GFI White Paper PCI-DSS compliance and GFI Software products White Paper PCI-DSS compliance and Software products The Payment Card Industry Data Standard () compliance is a set of specific security standards developed by the payment brands* to help promote the adoption

More information

IBM Tivoli Endpoint Manager for Security and Compliance

IBM Tivoli Endpoint Manager for Security and Compliance IBM Endpoint Manager for Security and Compliance A single solution for managing endpoint security across the organization Highlights Provide up-to-date visibility and control from a single management console

More information

Patch Management Marvin Christensen /CIAC

Patch Management Marvin Christensen /CIAC Patch Management Marvin Christensen /CIAC US DOE Cyber Security Group 2004 Training Conference May 26, 2004 Management Track 11:00 am 11:45 pm UCRL-CONF-204220 CIAC 04-099 This work was performed under

More information

Dynamic Data Center Compliance with Tripwire and Microsoft

Dynamic Data Center Compliance with Tripwire and Microsoft Dynamic Data Center Compliance with Tripwire and Microsoft white paper Configuration Control for Virtual and Physical Infrastructures For IT, gaining and maintaining compliance with one or more regulations

More information

AN OVERVIEW OF VULNERABILITY SCANNERS

AN OVERVIEW OF VULNERABILITY SCANNERS AN OVERVIEW OF VULNERABILITY SCANNERS February 2008 The Government of the Hong Kong Special Administrative Region The contents of this document remain the property of, and may not be reproduced in whole

More information

CA Vulnerability Manager r8.3

CA Vulnerability Manager r8.3 PRODUCT BRIEF: CA VULNERABILITY MANAGER CA Vulnerability Manager r8.3 CA VULNERABILITY MANAGER PROTECTS ENTERPRISE SYSTEMS AND BUSINESS OPERATIONS BY IDENTIFYING VULNERABILITIES, LINKING THEM TO CRITICAL

More information

FREQUENTLY ASKED QUESTIONS

FREQUENTLY ASKED QUESTIONS FREQUENTLY ASKED QUESTIONS Secure Bytes, October 2011 This document is confidential and for the use of a Secure Bytes client only. The information contained herein is the property of Secure Bytes and may

More information

Seven Practical Steps to Delivering More Secure Software. January 2011

Seven Practical Steps to Delivering More Secure Software. January 2011 Seven Practical Steps to Delivering More Secure Software January 2011 Table of Contents Actions You Can Take Today 3 Delivering More Secure Code: The Seven Steps 4 Step 1: Quick Evaluation and Plan 5 Step

More information

Key Considerations for Vulnerability Management: Audit and Compliance

Key Considerations for Vulnerability Management: Audit and Compliance Key Considerations for Vulnerability Management: Audit and Compliance October 5, 2005 2005 Altiris Inc. All rights reserved. ABOUT ALTIRIS Altiris, Inc. is a pioneer of IT lifecycle management software

More information

Host Hardening. OS Vulnerability test. CERT Report on systems vulnerabilities. (March 21, 2011)

Host Hardening. OS Vulnerability test. CERT Report on systems vulnerabilities. (March 21, 2011) Host Hardening (March 21, 2011) Abdou Illia Spring 2011 CERT Report on systems vulnerabilities Source: CERT Report @ http://www.kb.cert.org/vuls/bymetric 2 OS Vulnerability test Source: http://www.omninerd.com/articles/2006_operating_system_vulnerabilit

More information

Patch Management Policy

Patch Management Policy Patch Management Policy L2-POL-12 Version No :1.0 Revision History REVISION DATE PREPARED BY APPROVED BY DESCRIPTION Original 1.0 2-Apr-2015 Process Owner Management Representative Initial Version No.:

More information

Altiris Patch Management Solution for Windows 7.1 SP2 from Symantec User Guide

Altiris Patch Management Solution for Windows 7.1 SP2 from Symantec User Guide Altiris Patch Management Solution for Windows 7.1 SP2 from Symantec User Guide Altiris Patch Management Solution for Windows 7.1 SP2 from Symantec User Guide The software described in this book is furnished

More information

Security Maintenance Practices. IT 4823 Information Security Administration. Patches, Fixes, and Revisions. Hardening Operating Systems

Security Maintenance Practices. IT 4823 Information Security Administration. Patches, Fixes, and Revisions. Hardening Operating Systems IT 4823 Information Security Administration Securing Operating Systems June 18 Security Maintenance Practices Basic proactive security can prevent many problems Maintenance involves creating a strategy

More information

Upon completion of this chapter, you will able to answer the following questions:

Upon completion of this chapter, you will able to answer the following questions: CHAPTER 2 Operating Systems Objectives Upon completion of this chapter, you will able to answer the following questions: What is the purpose of an OS? What role do the shell and kernel play? What is the

More information

Network and Host-based Vulnerability Assessment

Network and Host-based Vulnerability Assessment Network and Host-based Vulnerability Assessment A guide for information systems and network security professionals 6600 Peachtree-Dunwoody Road 300 Embassy Row Atlanta, GA 30348 Tel: 678.443.6000 Toll-free:

More information

Microsoft Technologies

Microsoft Technologies NETWORK ENGINEERING TRACK Microsoft Technologies QUARTER 1 DESKTOP APPLICATIONS - ESSENTIALS Module 1 - Office Applications This subject enables users to acquire the necessary knowledge and skills to use

More information

Proactively Managing Servers with Dell KACE and Open Manage Essentials

Proactively Managing Servers with Dell KACE and Open Manage Essentials Proactively Managing Servers with Dell KACE and Open Manage Essentials A Dell Technical White Paper Dell KACE Dell Open Manage Essentials THIS WHITE PAPER IS FOR INFORMATIONAL PURPOSES ONLY, AND MAY CONTAIN

More information

IBM Tivoli Monitoring for Databases

IBM Tivoli Monitoring for Databases Enhance the availability and performance of database servers IBM Tivoli Monitoring for Databases Highlights Integrated, intelligent database monitoring for your on demand business Preconfiguration of metric

More information

September 2005 Report No. 05-031. FDIC s Information Technology Configuration Management Controls Over Operating System Software

September 2005 Report No. 05-031. FDIC s Information Technology Configuration Management Controls Over Operating System Software September 2005 Report No. 05-031 FDIC s Information Technology Configuration Management Controls Over Operating System Software Report No. 05-031 September 2005 FDIC s Information Technology Configuration

More information

Healthcare Information Security Governance and Public Safety II

Healthcare Information Security Governance and Public Safety II Healthcare Information Security Governance and Public Safety II Technical Track Seminar Agenda 8/26/2009 1 Vulnerability Assessment, Vulnerability Management and Penetration Testing PART 1 9:00 10:30 Anatomy

More information

Automated Patching. Paul Asadoorian IT Security Specialist Brown University

Automated Patching. Paul Asadoorian IT Security Specialist Brown University Automated Patching Paul Asadoorian IT Security Specialist Brown University Outline Automated Patching Introduction Tools from Microsoft Microsoft SUS Microsoft SMS Others HFNetCheck Pro (Shavlik) Novell

More information

Five ways to simplify the vulnerability management lifecycle. Scott Sidel, CISSP, CEH, ETC May 2005

Five ways to simplify the vulnerability management lifecycle. Scott Sidel, CISSP, CEH, ETC May 2005 Five ways to simplify the vulnerability management lifecycle Scott Sidel, CISSP, CEH, ETC May 2005 Why do we patch? No system is perfect. Vulnerabilities ship out-of-the-box Threats on the wire Even while

More information

PGP Command Line Version 10.2 Release Notes

PGP Command Line Version 10.2 Release Notes PGP Command Line Version 10.2 Release Notes Thank you for using this Symantec Corporation product. These Release Notes contain important information regarding this release of PGP Command Line. Symantec

More information

Scanless Vulnerability Assessment:

Scanless Vulnerability Assessment: Scanless Vulnerability Assessment: Skybox Security whitepaper July 2014 1 Overview Vulnerability scanning, or the process of identifying a list of known security gaps in the network environment, is the

More information

capacity management for StorageWorks NAS servers

capacity management for StorageWorks NAS servers application notes hp OpenView capacity management for StorageWorks NAS servers First Edition (February 2004) Part Number: AA-RV1BA-TE This document describes how to use HP OpenView Storage Area Manager

More information

Installing GFI LANguard Network Security Scanner

Installing GFI LANguard Network Security Scanner Installing GFI LANguard Network Security Scanner System requirements Install GFI LANguard Network Security Scanner on a computer which meets the following requirements: Windows 2000 (SP4) / XP (SP2) /

More information

Scanless Vulnerability Assessment. A Next-Generation Approach to Vulnerability Management

Scanless Vulnerability Assessment. A Next-Generation Approach to Vulnerability Management Scanless Vulnerability Assessment A Next-Generation Approach to Vulnerability Management WHITEPAPER Overview Vulnerability scanning, or the process of identifying a list of known security gaps in the network

More information

BMC BladeLogic Client Automation Installation Guide

BMC BladeLogic Client Automation Installation Guide BMC BladeLogic Client Automation Installation Guide Supporting BMC BladeLogic Client Automation 8.2.02 January 2013 www.bmc.com Contacting BMC Software You can access the BMC Software website at http://www.bmc.com.

More information

Heroix Longitude Quick Start Guide V7.1

Heroix Longitude Quick Start Guide V7.1 Heroix Longitude Quick Start Guide V7.1 Copyright 2011 Heroix 165 Bay State Drive Braintree, MA 02184 Tel: 800-229-6500 / 781-848-1701 Fax: 781-843-3472 Email: support@heroix.com Notice Heroix provides

More information

Citadel Security Software Inc.

Citadel Security Software Inc. i Citadel Security Software Inc. Hercules Vulnerability Assessment and Remediation Overview Document Number: 205-01-0007 Hercules v4.1 Document Version: 1.0 May 2006 Acknowledgements THIS SOFTWARE AND

More information

Measurably reducing risk through collaboration, consensus & practical security management. 2013 CIS Security Benchmarks 1

Measurably reducing risk through collaboration, consensus & practical security management. 2013 CIS Security Benchmarks 1 Measurably reducing risk through collaboration, consensus & practical security management 2013 CIS Security Benchmarks 1 Background City University of New York s Rights and Benefits as a CIS Security Benchmarks

More information

OPEN SOURCE SECURITY

OPEN SOURCE SECURITY OPEN SOURCE SECURITY February 2008 The Government of the Hong Kong Special Administrative Region The contents of this document remain the property of, and may not be reproduced in whole or in part without

More information

Implementing Security Update Management

Implementing Security Update Management Implementing Security Update Management Wayne Harris MCSE Senior Consultant Certified Security Solutions Business Case for Update Management When determining the potential financial impact of poor update

More information

How PatchLink Meets the Top 10 Requirements for Enterprise Patch and Vulnerability Management. White Paper Sept. 2006

How PatchLink Meets the Top 10 Requirements for Enterprise Patch and Vulnerability Management. White Paper Sept. 2006 How PatchLink Meets the Top 10 Requirements for Enterprise Patch and Vulnerability Management White Paper Sept. 2006 Introduction It happens, five, ten, twenty times a month: A hardware or software vendor

More information

Nessus Agents. October 2015

Nessus Agents. October 2015 Nessus Agents October 2015 Table of Contents Introduction... 3 What Are Nessus Agents?... 3 Scanning... 4 Results... 6 Conclusion... 6 About Tenable Network Security... 6 2 Introduction Today s changing

More information

ANNEXURE-1 TO THE TENDER ENQUIRY NO.: DPS/AMPU/MIC/1896. Network Security Software Nessus- Technical Details

ANNEXURE-1 TO THE TENDER ENQUIRY NO.: DPS/AMPU/MIC/1896. Network Security Software Nessus- Technical Details Sub: Supply, Installation, setup and testing of Tenable Network Security Nessus vulnerability scanner professional version 6 or latest for scanning the LAN, VLAN, VPN and IPs with 3 years License/Subscription

More information

SCAP for VoIP Automating Configuration Compliance. 6 th Annual IT Security Automation Conference

SCAP for VoIP Automating Configuration Compliance. 6 th Annual IT Security Automation Conference SCAP for VoIP Automating Configuration Compliance 6 th Annual IT Security Automation Conference Presentation Overview 1. The Business Challenge 2. Securing Voice over IP Networks 3. The ISA VoIP Security

More information

Assuria Auditor The Configuration Assurance, Vulnerability Assessment, Change Detection and Policy Compliance Reporting Solution for Enterprise

Assuria Auditor The Configuration Assurance, Vulnerability Assessment, Change Detection and Policy Compliance Reporting Solution for Enterprise Assuria Auditor The Configuration Assurance, Vulnerability Assessment, Change Detection and Policy Compliance Reporting Solution for Enterprise 1. Introduction Information security means protecting information

More information

Enterprise Cybersecurity Best Practices Part Number MAN-00363 Revision 006

Enterprise Cybersecurity Best Practices Part Number MAN-00363 Revision 006 Enterprise Cybersecurity Best Practices Part Number MAN-00363 Revision 006 April 2013 Hologic and the Hologic Logo are trademarks or registered trademarks of Hologic, Inc. Microsoft, Active Directory,

More information

Change Manager 5.0 Installation Guide

Change Manager 5.0 Installation Guide Change Manager 5.0 Installation Guide Copyright 1994-2008 Embarcadero Technologies, Inc. Embarcadero Technologies, Inc. 100 California Street, 12th Floor San Francisco, CA 94111 U.S.A. All rights reserved.

More information

VERITAS NetBackup BusinesServer

VERITAS NetBackup BusinesServer VERITAS NetBackup BusinesServer A Scalable Backup Solution for UNIX or Heterogeneous Workgroups V E R I T A S W H I T E P A P E R Table of Contents Overview...................................................................................1

More information

FDCC & SCAP Content Challenges. Kent Landfield Director, Risk and Compliance Security Research McAfee Labs

FDCC & SCAP Content Challenges. Kent Landfield Director, Risk and Compliance Security Research McAfee Labs FDCC & SCAP Content Challenges Kent Landfield Director, Risk and Compliance Security Research McAfee Labs Where we have been 1 st Security Automation Workshop nearly 20 people in a small room for the day

More information

Streamlining Patch Testing and Deployment

Streamlining Patch Testing and Deployment Streamlining Patch Testing and Deployment Using VMware GSX Server with LANDesk Management Suite to improve patch deployment speed and reliability Executive Summary As corporate IT departments work to keep

More information

The Operating System Lock Down Solution for Linux

The Operating System Lock Down Solution for Linux The Operating System Lock Down Solution for Linux The Challenge: Meeting Organizational Security Requirements Linux Operating System Security Operating system (OS) security is a priority for System Administrators

More information

Snare System Version 6.3.5 Release Notes

Snare System Version 6.3.5 Release Notes Snare System Version 6.3.5 Release Notes is pleased to announce the release of Snare Server Version 6.3.5. Snare Server Version 6.3.5 Bug Fixes: The Agent configuration retrieval functionality within the

More information

http://www.vassure.com

http://www.vassure.com Technical Case Study: Patch Management This is subsequent to Summary of Projects VMware - ESX Server to Facilitate: IMS, Server Consolidation, Storage & Testing with Production Server VAssure Virtualization

More information

Symantec Critical System Protection Configuration Monitoring Edition Release Notes

Symantec Critical System Protection Configuration Monitoring Edition Release Notes Symantec Critical System Protection Configuration Monitoring Edition Release Notes Symantec Critical System Protection Configuration Monitoring Edition Release Notes The software described in this book

More information

Host-Oriented Security Test Suite (HOSTS)

Host-Oriented Security Test Suite (HOSTS) 1 Host-Oriented Security Test Suite (HOSTS) James A. Finegan 18th Annual Computer Security Applications Conference Enterprise Security December 12, 2002 1 2 Agenda Problem Description What is HOSTS? -

More information

While most organizations have addressed the various

While most organizations have addressed the various The Vulnerabilities of Developing on the Net Disaster has struck. You would think that firewalls, combined with filtering routers, password protection, encryption, and disciplined use of access controls

More information

Virtual Server and Storage Provisioning Service. Service Description

Virtual Server and Storage Provisioning Service. Service Description RAID Virtual Server and Storage Provisioning Service Service Description November 28, 2008 Computer Services Page 1 TABLE OF CONTENTS INTRODUCTION... 4 VIRTUAL SERVER AND STORAGE PROVISIONING SERVICE OVERVIEW...

More information

Compatibility Matrixes. Blackboard Academic Suite

Compatibility Matrixes. Blackboard Academic Suite Compatibility Matrixes Application Pack 3 (Release 6.3) Blackboard Learning System Blackboard Community System Blackboard Learning System - Basic Edition (Release 2.3) Blackboard Content System PRODUCT

More information

DocuShare Installation Guide

DocuShare Installation Guide DocuShare Installation Guide Publication date: February 2011 This document supports DocuShare Release 6.6.1 Prepared by: Xerox Corporation DocuShare Business Unit 3400 Hillview Avenue Palo Alto, California

More information

IBM Tivoli Endpoint Manager for Lifecycle Management

IBM Tivoli Endpoint Manager for Lifecycle Management IBM Endpoint Manager for Lifecycle Management A single-agent, single-console approach for endpoint management across the enterprise Highlights Manage hundreds of thousands of endpoints regardless of location,

More information

Linux Technologies QUARTER 1 DESKTOP APPLICATIONS - ESSENTIALS QUARTER 2 NETWORKING AND OPERATING SYSTEMS ESSENTIALS. Module 1 - Office Applications

Linux Technologies QUARTER 1 DESKTOP APPLICATIONS - ESSENTIALS QUARTER 2 NETWORKING AND OPERATING SYSTEMS ESSENTIALS. Module 1 - Office Applications NETWORK ENGINEERING TRACK Linux Technologies QUARTER 1 DESKTOP APPLICATIONS - ESSENTIALS Module 1 - Office Applications This subject enables users to acquire the necessary knowledge and skills to use Office

More information

IBM Tivoli Endpoint Manager for Lifecycle Management

IBM Tivoli Endpoint Manager for Lifecycle Management IBM Endpoint Manager for Lifecycle Management A single-agent, single-console approach for endpoint management across the enterprise Highlights Manage hundreds of thousands of endpoints regardless of location,

More information

Payment Card Industry (PCI) Data Security Standard

Payment Card Industry (PCI) Data Security Standard Payment Card Industry (PCI) Data Security Standard Technical and Operational Requirements for Approved Scanning Vendors (ASVs) Version 1.1 Release: September 2006 Table of Contents Introduction...1-1 Naming

More information

Spooks in the Machine

Spooks in the Machine A Higher Education Services Company Spooks in the Machine Proactive Strategies for Securing the Network Steven M. Helwig, CISSP Technical Director shelwig@sungardcollegis.com Contents of Presentation Aligning

More information

Business Intelligence Tutorial

Business Intelligence Tutorial IBM DB2 Universal Database Business Intelligence Tutorial Version 7 IBM DB2 Universal Database Business Intelligence Tutorial Version 7 Before using this information and the product it supports, be sure

More information

Citadel Security Software Inc.

Citadel Security Software Inc. i Citadel Security Software Inc. Hercules Vulnerability Assessment and Remediation Overview Document Number: 205-01-0007 Hercules v3.5.1 Document Version: 1.0 February 2005 Acknowledgements THIS SOFTWARE

More information

Nessus and Mobile Device Scanning. November 7, 2014 (Revision 12)

Nessus and Mobile Device Scanning. November 7, 2014 (Revision 12) Nessus and Mobile Device Scanning November 7, 2014 (Revision 12) Table of Contents Introduction... 3 Standards and Conventions... 3 Overview... 3 Scanning for Mobile Devices with Nessus... 4 Creating a

More information

A Database Security Management White Paper: Securing the Information Business Relies On. November 2004

A Database Security Management White Paper: Securing the Information Business Relies On. November 2004 A Database Security Management White Paper: Securing the Information Business Relies On November 2004 IPLocks, Inc. 441-A W. Trimble Road, San Jose, CA 95131 USA A Database Security Management White Paper:

More information

IBM Rational Asset Manager

IBM Rational Asset Manager Providing business intelligence for your software assets IBM Rational Asset Manager Highlights A collaborative software development asset management solution, IBM Enabling effective asset management Rational

More information

Altiris Patch Management Solution for Linux 7.1 SP2 from Symantec User Guide

Altiris Patch Management Solution for Linux 7.1 SP2 from Symantec User Guide Altiris Patch Management Solution for Linux 7.1 SP2 from Symantec User Guide Altiris Patch Management Solution for Linux 7.1 SP2 from Symantec User Guide The software described in this book is furnished

More information

Using. DataTrust Secure Online Backup. To Protect Your. Hyper-V Virtual Environment. 1 P a g e

Using. DataTrust Secure Online Backup. To Protect Your. Hyper-V Virtual Environment. 1 P a g e Using DataTrust Secure Online Backup To Protect Your Hyper-V Virtual Environment. 1 P a g e Table of Contents: 1. Backing Up the Guest OS with DataTrustOBM 3 2. Backing up the Hyper-V virtual machine files

More information

Symantec Enterprise Security Manager Patch Policy Release Notes

Symantec Enterprise Security Manager Patch Policy Release Notes Symantec Enterprise Security Manager Patch Policy Release Notes Symantec Enterprise Security Manager Patch Policy Release Notes The software described in this book is furnished under a license agreement

More information

PGP Command Line Version 10.3 Release Notes

PGP Command Line Version 10.3 Release Notes PGP Command Line Version 10.3 Release Notes Page 1 of 6 PGP Command Line Version 10.3 Release Notes Thank you for using this Symantec Corporation product. These Release Notes contain important information

More information

Dell KACE K1000 System Management Appliance Version 5.4. Patching and Security Guide

Dell KACE K1000 System Management Appliance Version 5.4. Patching and Security Guide Dell KACE K1000 System Management Appliance Version 5.4 Patching and Security Guide October 2012 2004-2012 Dell Inc. All rights reserved. Reproduction of these materials in any manner whatsoever without

More information

An Introduction to the Common Configuration Enumeration

An Introduction to the Common Configuration Enumeration An Introduction to the Common Configuration Enumeration Version: 1.7 Date: July 24, 2008 Author: David Mann Table of Contents 1 Introduction 2 2 Moderation 2 2.1 MITRE and Information Assurance Data Standards

More information

Advanced Event Viewer Manual

Advanced Event Viewer Manual Advanced Event Viewer Manual Document version: 2.2944.01 Download Advanced Event Viewer at: http://www.advancedeventviewer.com Page 1 Introduction Advanced Event Viewer is an award winning application

More information

BMC Client Management - SCAP Implementation Statement. Version 12.0

BMC Client Management - SCAP Implementation Statement. Version 12.0 BMC Client Management - SCAP Implementation Statement Version 12.0 BMC Client Management - SCAP Implementation Statement TOC 3 Contents SCAP Implementation Statement... 4 4 BMC Client Management - SCAP

More information

Use of the Common Vulnerabilities and Exposures (CVE) Vulnerability Naming Scheme

Use of the Common Vulnerabilities and Exposures (CVE) Vulnerability Naming Scheme NIST Special Publication 800-51 Use of the Common Vulnerabilities and Exposures (CVE) Vulnerability Naming Scheme Recommendations of the National Institute of Standards and Technology Peter Mell Tim Grance

More information

Veritas Cluster Server by Symantec

Veritas Cluster Server by Symantec Veritas Cluster Server by Symantec Reduce application downtime Veritas Cluster Server is the industry s leading clustering solution for reducing both planned and unplanned downtime. By monitoring the status

More information

Radia Cloud. User Guide. For the Windows operating systems Software Version: 9.10. Document Release Date: June 2014

Radia Cloud. User Guide. For the Windows operating systems Software Version: 9.10. Document Release Date: June 2014 Radia Cloud For the Windows operating systems Software Version: 9.10 User Guide Document Release Date: June 2014 Software Release Date: June 2014 Legal Notices Warranty The only warranties for products

More information

Product Brief. DC-Protect. Content based backup and recovery solution. By DATACENTERTECHNOLOGIES

Product Brief. DC-Protect. Content based backup and recovery solution. By DATACENTERTECHNOLOGIES Product Brief DC-Protect Content based backup and recovery solution By DATACENTERTECHNOLOGIES 2002 DATACENTERTECHNOLOGIES N.V. All rights reserved. This document contains information proprietary and confidential

More information

Virtual Patching: a Proven Cost Savings Strategy

Virtual Patching: a Proven Cost Savings Strategy Virtual Patching: a Proven Cost Savings Strategy An Ogren Group Special Report December 2011 Executive Summary Security executives, pushing the limits of traditional labor-intensive IT patch processes

More information

APPLICATION SECURITY RESPONSE: WHEN HACKERS COME A-KNOCKING

APPLICATION SECURITY RESPONSE: WHEN HACKERS COME A-KNOCKING APPLICATION SECURITY RESPONSE: WHEN HACKERS COME A-KNOCKING Katie Moussouris Senior Security Strategist Microsoft Security Response Center http://twitter.com/k8em0 (that s a zero) Session ID: ASEC-T18

More information

Symantec's Continuous Monitoring Solution

Symantec's Continuous Monitoring Solution Preparing for FISMA 2.0 and Continuous Monitoring Requirements Symantec's Continuous Monitoring Solution White Paper: Preparing for FISMA 2.0 and Continuous Monitoring Requirements Contents Introduction............................................................................................

More information

LANDESK SOLUTION BRIEF. Patch Management

LANDESK SOLUTION BRIEF. Patch Management Patch Management Increase the safety, security and efficiency of critical IT systems so IT can spend less time maintaining the computing environment and more time improving it. Develop and maintain patch

More information