04-22-2013 09:28 AM - edited 03-10-2019 12:02 AM
With Omar Santos
Welcome to the Cisco Support Community Ask the Expert conversation. This is an opportunity to learn and ask questions about Cisco's Product Security Incident Response Team (PSIRT) including Open Vulnerability and Assessment Language (OVAL) definitions in Cisco IOS Software security advisories. OVAL provides a structured and standard machine-readable content that allows customers to quickly consume security vulnerability information and identify affected devices.
You can ask things like how customers can use OVAL to quickly assess the effects of security vulnerabilities in Cisco IOS Software devices as well as how to provide step-by-step instructions on how to use OVAL content with available open source tools, and about security automation and machine-readable content.
Omar Santos is an incident manager with Cisco's PSIRT. He has designed, implemented, and supported numerous secure networks for Fortune 500 companies and the U.S. government, including the U.S. Marine Corps and the U.S. Department of Defense. He is also the author of many Cisco online technical documents and configuration guidelines. Prior to his current role, he was a technical leader within the World Wide Security Practice and Cisco's Technical Assistance Center (TAC), where he taught, led, and mentored many engineers within both organizations. He is an active member of the InfraGard organization. InfraGard is a cooperative undertaking between the Federal Bureau of Investigation and an association of businesses, academic institutions, state and local law enforcement agencies, and other participants that is dedicated to increasing the security of the critical infrastructures of the United States of America. Santos has also delivered numerous technical presentations to Cisco customers and partners; as well as executive presentations to CEOs, CIOs, and CSOs of many organizations. He is also the author of these Cisco Press books: Cisco ASA: All-in-One Firewall, IPS, and VPN Adaptive Security Appliance; Cisco Network Admission Control, Volume II: NAC Deployment and Troubleshooting; End-to-End Network Security: Defense-in-Depth; and Cisco ASA: All-in-One Firewall, IPS, Anti-X, and VPN Adaptive Security Appliance (2nd Edition).
Remember to use the rating system to let Omar know if you have received an adequate response.
Omar might not be able to answer each question due to the volume expected during this event. Remember that you can continue the conversation on the Security community Other Security subcommunity shortly after the event. This event lasts through Friday May 3, 2013. Visit this forum often to view responses to your questions and the questions of other Cisco Support Community members.
Webcast related links:
.
04-24-2013 11:38 AM
When are security advisories posted by PSIRT?
04-25-2013 09:47 AM
Hi John,
Cisco generally discloses Cisco Security Advisories at 1600 GMT on any given Wednesday. For Cisco IOS Software security vulnerabilities and because of direct customer feedback, Cisco releases bundles of Cisco IOS Software Security Advisories at 1600 GMT on the fourth Wednesday in March and September each year. This schedule applies to the disclosure of Cisco IOS Software vulnerabilities and does not apply to the disclosure of vulnerabilities in other Cisco products.
This is documented in our Security Vulnerability Policy at the following link:
http://www.cisco.com/en/US/products/products_security_vulnerability_policy.html#ds
Thank you!
Omar
04-29-2013 09:19 AM
Thanks Omar! That was helpful. Another quick question for you...is OVAL free?
04-29-2013 09:32 AM
Hi John,
All OVAL content that Cisco creates for security advisories is completely free. The OVAL definitions can be downloaded from each IOS security advisory.
I have included more information on the following blog post, as well as in the webcast (recording and slides):
http://blogs.cisco.com/security/automating-cisco-ios-vulnerability-assessment/
If you are referring to the OVAL language, it is also free. It is an industry-adopted standard led by MITRE.
A frequently asked questions (FAQ) document has been published at the following location to help answer some of the common questions related to Cisco’s OVAL adoption:
http://www.cisco.com/web/about/security/intelligence/oval_faq.html
Thanks!
Omar
05-02-2013 01:51 PM
Thanks much. Another question...can I put an OVAL definition inside of a CVRF XML?
05-03-2013 12:32 PM
Hi,
In the currrent version of CVRF (1.1) this is not supported. However, there have been talks on supporting this in the future. As a matter of fact, Cisco is taking an active roll on this and working with the industry to support this in the future.
Thanks!
Omar
Discover and save your favorite ideas. Come back to expert answers, step-by-step guides, recent topics, and more.
New here? Get started with these tips. How to use Community New member guide