-: Standardizing vulnerabilities.
So, when we have all these different
vulnerability management tools, how do we know what
vulnerabilities are standard across the platforms.
Well, the way that we do this is because
we have so many different tools and protocols,
and there is no common protocol,
they came up with a thing called SCAP,
or Security Content Automation Protocol.
This was developed by NIST standardization
to get us vulnerability management
across all the different softwares to be the same.
And this allows them to talk to each other
in a common language.
Now you can find this at scap.nist.gov
and it comes from the NIST special publications
standard 800-117.
So again, if you're trying to setup
a vulnerability management program,
I highly recommend you look at that special publication,
because it's going to tell you how you can adopt
and use SCAP in your organization to ensure you have
a standardized way of talking about vulnerabilities.
So, when we talk about that
there's many different things that come under SCAP.
The first one is the CCE
or the Common Configuration Enumeration.
This is a standard way of naming
system configuration issues.
So, this is just all about your configurations
in Windows or Linux and it's gonna give you a common way
of talking about them and discussing them.
CPE is actually Common Platform Enumeration.
This is gonna give you a standardized name set
for all your product names and versions.
So if I'm talking about Nessus Version 6,
everyone else knows that I'm talking about.
Now, the most important ones on this page, are CVE and CVSS.
CVE stands for Common Vulnerabilities and Exposures.
As you noticed in the last lesson,
I brought up the fact that Nessus had a vulnerability
back in 2003, and it had CVE-2003- some number.
That's a common way of articulating
what vulnerabilities exist and what exposure's out there.
This gives you the standard name
for security related software flaws.
Every time a new bug is found,
every time Microsoft releases a new patch,
there is a CVE number that is associated with it
and all of the tools whether you're using
QualysGuard, Nessus, OpenVAS, or any of the other ones
will understand what that CVE is
and it's a common referencing mechanism.
The other thing that comes from a CVE
is what's called a CVSS score.
And this is a common vulnerability scoring system.
It's a standard approach for us to categorize
the severity a of software flaw,
where 10 is the most critical and one is the least critical.
And they actually break this down from one to four as low,
four to six is medium, six through 10 is gonna be high,
and then when you get 10 and above, that's critical.
The other two that we have under SCAP is the XCDDF.
And that's the
Extensible Configuration Checklist Description Format.
Long way of saying, this is a language
for creating checklists and reporting your results.
And this is something that is common
to all of the platforms that all understand it.
OVAL or Open Vulnerability and Assessment Language,
is a language for low level testing procedures
used by those checklists.
So once we've created those checklists,
it can be an automated way to say,
well this checklist has 10 functions you have to do.
OVAL will tell you,
these are the 10 things and go about doing those 10 things.
Again, the two most important ones of this list
that we just went over, CVE and CVSS.
Keep those in mind, especially if you're gonna be
studying for the exam for the CSA+.
We're gonna go more into CVSS scores
in a future lesson as well.
(energetic electronic music)