Page Comparison

Anchor
top top

What's covered

standards

Compliance

Implementation

Related Links

Anchor
standards standards

Standards

Back to Top

Security Analysis Solution (SAS) is built completely around the SCAP standard, allowing customers to import and manage their XCCDF benchmarks (checklists) which are used for assessing their computers. Security standards and their acronyms are included in the following list:

Anchor
compliance compliance

Compliance

...

Back to Top

SAS supports: 

Standard	Supported Versions
SCAP	1.0 - 1.1 2
OVAL	5.3 - 5.9 11
XCCDF	1.0 - 1.1.4 2
CCE	5.0
CPE	2.2 3
CVSS	2.0

SAS is SCAP-compliant with these following capabilities: 

• FDCC Scanner
• Authenticated Configuration Scanner
• Authenticated Vulnerability and Patch Scanner

Anchor
imp imp

Implementation

Back to Top

SCAP

Security Content Automation Protocol (SCAP ) is a public specification that provides for standardized and automatable automated security configuration configurations, and vulnerability assessment, comprised of the eXtensible Configuration Checklist Description Format (XCCDF), Open Vulnerability and Assessment Language (OVAL), Common Platform Enumeration (CPE), Common Configuration Enumeration (CCE), Common Vulnerabilities and Exposures (CVE) and Common Vulnerability Scoring System (CVSS).assessments. SCAP comprises the following standards:

• XCCDF
• OVAL
• CPE
• CCE
• CVE
• CVSS

The Federal Desktop Core Configuration (FDCC) and U.S. Government Baseline (USGCB) are examples of the SCAP specification, mandated across all U.S. federal agents agencies and made openly available to for other organizations to leverage.

Effective Security Configuration Management configuration management products help firms organizations manage security proactively . By combining elements of vulnerability assessment, patch management, automated remediation and configuration compliance, these products can help reduce risks by ensuring that systems are configured properly.Arellia Security Analysis Solution embraces the SCAP standard to help meet these goals, providing the ability to and ensure proper system configuration by combining the following elements:

• Vulnerability assessment
• Patch management
• Automated remediation
• Configuration compliance

SAS embraces the SCAP standard and can import SCAP content into the Symantec Management Platform CMDB and allows for the continuous monitoring of security configuration management issues that arise due to system vulnerability and misconfiguration on endpoints within an organization.

Through fully automated processes, users can define policies that enforce the assessment of tailored SCAP profiles on a scheduled basis, optionally followed by automated remediation to keep their managed computers compliant. The results of these assessments and remediation are all collected and stored in the CMDB, allowing for rich reporting, alerting and data exchange. All data imported and collected can be leveraged to precisely identify specific conditions and turned into actionable tasks, furthering configuration compliance.

XCCDF

Arellia Security Analysis Solution is compatible with Extensible Configuration Checklist Description Format (XCCDF) Thycotic Management Server (TMS). For further details, go to SAS 8.1 overview. 

XCCDF

SAS is compatible with XCCDF benchmarks and other types of checklists that adhere to the XCCDF specification including industry -standard ones from FDCC, USGCB, HIPAA, SOX and PCI-DSS.standards from:

• Federal Desktop Core Confederation (FDCC)
• United States Government Configuration Baseline (USGCB)
• Health Insurance Portability and Accountability Act (HIPAA)
• Sarbanes-Oxley Act (SOX)
• Payment Card Industry Data Security Standard (PCI-DSS)

These benchmarks can be downloaded directly within the product on SAS on the Download Profiles page, which presents a list of links to the author's published content from sources such as NIST. The product SAS also supports uploading multiple benchmarks or other checklists through the web browser interface , directly from the user's file system in the form of XML files or compressed (ZIP) files of XML documents.

During the import of these benchmarks, the profiles and other related SCAP elements are correlated within the CMDBthe TMS during the import of these benchmarks. The profiles are then , used within security configuration policies to , perform scheduled assessments and (optionally) automated remediation to keep the targeted computers in compliance to with the policies defined by the computer administrator.

Assessment results can be output as XCCDF Results results and made available in many reports across multiple endpoints and even between various OVAL checks, taking full advantage of customer's investments in CMDB-related configuration management.

See Also:

• Security Profiles

OVAL

Arellia Security Analysis Solution supports Open Vulnerability Assessment Language (OVAL). OVAL is .

For further information, go to Security configuration profiles.

OVAL

SAS supports OVAL, a public standard for creating vulnerability, configuration, and patch checks using a declarative XML syntax.

Arellia Security Analysis Solution SAS imports OVAL content from SCAP data content streams. The product performs the evaluation of OVAL DefinitionsstreTMS and evaluates OVAL definitions, generally in the context of XCCDF Benchmark Profilesbenchmark profiles, to test configuration settings and vulnerabilities on managed computers through an agent-based plug-in to the Symantec Management Agent. XCCDF provides ways to adjust adjusts the configuration of these assessments to better suit the customer needs, all orchestrated within our user interface.

Arellia Security Analysis Solution also provides ways to report SAS also reports individual or group assessment results across multiple computers that have performed these assessments, giving rich reporting data that can be used for other system configuration management tasks and policies.

OVAL content is delivered to the endpoints where the assessments are performed resulting in OVAL Results results being sent back to the server and correlated into the CMDBTMS, giving the administrators access to the OVAL and XCCDF compliant XML output as well as numerous reports than can correlate these assessments to the managed elements within the CMDBTMS.

CCE

Arellia Security Analysis Solution SAS supports the public standard Common Configuration Enumeration ( CCE), which provides an identification system for common security configuration issues and vulnerabilities. These identifiers are referenced within the SCAP and OVAL content.

The product shows the relationship of the CCEs to the OVAL checks within the view of a profile as well as within and in the results of an assessment performed on computers. These relationships are also modeled within the CMDB TMS to provide for cross-profile views of assessment results, allowing the administrator administrators to run reports that can filter the results to specific computers or groups of computers that have specific CCE results. There are numerous other reports that can be built based on these relationships, giving the administrator administrators full control of the related data within the CMDBTMS.

CCE references are also present in the OVAL Results results product output, as well as a CSV formatted file output, all accessible through the Resource Explorer user interface.

CPE

Common Platform Enumeration (CPE) is an open standard that describes IT platforms (such as hardware, operating systems and applications). XCCDF Benchmarks define applicable platforms through CPE designations.

Upon import of the XCCDF benchmarks, Arellia Security Analysis Solution SAS will extract all CPE references, then analyze and process them against the managed computers to build filters used within the Symantec Management PlatformTMS. These filters are maintained and kept up-to-date through various tasks as new computers and profiles are introduced into the system. These targets can be used by other products, but have proven to be a good starting point for targeting assessments within Security Analysis security analysis policies.

When you create security configuration policies are created, use these CPE-based filters are used as a starting point for targeting the endpoints to perform the SCAP assessments. These policy targets can be further tailored to narrow down the policy to specific endpoints.

The CPE references are also viewable within result output and available to use when correlating results and assessed computers within reports and data exchange.

See Also:

...

CVE

Common Vulnerabilities and Exposures (CVE ) is a common identification and dictionary for computer and information security vulnerabilities, and is maintained and hosted by The the MITRE Corporation (http://cve.mitre.org). The National Vulnerability Database (NVD) publishes vulnerability summaries that provide detailed information for most known computer and information security vulnerabilities. These You can access these vulnerability summaries can be accessed using the CVE (Common Vulnerabilities and Exposures) identifier for a given vulnerability. NVD also regularly publishes NVD/CVE data feeds that store similar information but in a schema-defined and machine-readable format.

Arellia Security Analysis Solution SAS utilizes CVE identifiers to associate vulnerabilities identified in the imported SCAP data stream as well as the assessment results. When viewing the OVAL definitions within a profile, CVE identifiers are displayed with links to detail on the CVE website. Numerous reports are available within the product that show which computers are susceptible to the vulnerabilities identified by their CVE and combined with CVSS scoring metrics. The product SAS also stores CVE entities as unique resources within the CMDBTMS, leveraging the ability to associate and relate these to other CMDB TMS resources, giving the administrator rich reporting and targeting data to work from.

CVSS

Common Vulnerability Scoring System (CVSS ) is a public standard that defines methods for scoring and rating computer vulnerabilities. These vulnerabilities are referenced using a Common Vulnerabilities and Exposures ( CVE ) identifier and allow the administrator to prioritize and remediate those that pose the greatest risk. The CVSS list is maintained on the NIST website , providing and provides scores for common threats and vulnerabilities.

Arellia Thycotic Security Analysis Solution provides tasks that can be run on managed computers that will gather CVE analysis results and analyze this data to produce CVSS score information for the managed computers. The product also displays CVSS scoring details in reports for managed computers that have been analyzed, including the CVE ID, score level, availability impact, confidentiality impact, integrity impact, and published date information. There are also links to the CVEs in the product output where users that you can navigate to find additional information on the CVSS scores for the vulnerabilities.

Anchor
links links

Related links

Policies

Create a Security Analysis policy

Back to Top