Security automation is a hot topic these days. Most organizations have many systems to patch and configure securely, with numerous versions of software and features enabled. Many security administrators are seeking ways to leverage standards and available tools to reduce the complexity and time necessary to respond to security advisories, assess their devices, and ensure compliance so they can allocate resources to focus on other areas of their network and security infrastructure.
Cisco is committed to protect customers by sharing critical security-related information in different formats.
Also starting today, in addition to OVAL definitions, Cisco is publishing Common Vulnerability Reporting Framework (CVRF) content for all security advisories. CVRF allows vendors to publish security advisories in an XML format intended for the sharing of security-related information in a machine-readable format. CVRF has been designed by the Industry Consortium for Advancement of Security on the Internet (ICASI), of which Cisco is a member and took a major role in its development.
OVAL is an international community standard to promote open and publicly available security content, and to standardize the transfer of this information in security tools and services. OVAL is part of the Security Content Automation Protocol (SCAP) specifications. OVAL’s main purpose is to assist security administrators by accelerating the process of analyzing a system for the presence of a vulnerability or configuration best practices. MITRE’s OVAL website contains a detailed definition at the following link: http://oval.mitre.org/about/index.html
OVAL speeds up information exchange and processing of such security-related information. Using OVAL security administrators and other users can accelerate the process of detecting software vulnerabilities in Cisco IOS Software. OVAL content (often called “definitions”) can be downloaded directly from Cisco IOS security advisories. Each Cisco IOS security advisory includes a link to the corresponding OVAL definition(s).
The following figure (Figure 1) shows how customers can download OVAL and CVRF content directly from security advisories.
Figure 1 - OVAL and CVRF Content in Security Advisories
CVRF is available in all security advisories; however, OVAL is only supported in Cisco IOS advisories. Cisco is working with MITRE and the OVAL community to enhance and develop new schemata to enhanced Cisco IOS support and potentially other Cisco Products. Several changes have already been submitted and integrated in MITRE’s OVAL Language Sandbox.
OVAL Definitions are XML files that contain information about how to check a system for the presence of vulnerabilities, configuration issues, patches, installed applications, or other characteristics of such system. For vulnerability checks, definitions are written to check for a vulnerability, often identified by a specific Common Vulnerabilities and Exposures (CVE) identifier. OVAL definitions must comply with the OVAL Definition Schema, and should be written in accordance with the Authoring Style Guide defined by MITRE. MITRE’s “OVAL Definition Lifecycle” website has a detailed description of the OVAL definition process: http://oval.mitre.org/repository/about/stages.html
OVAL enables interoperability between security and network management products from different vendors in different vertical markets allowing them to quickly and automatically perform vulnerability and compliance assessment of network infrastructure and networking devices. All organizations participating in the OVAL Adoption Program are listed in MITRE’s website at: http://oval.mitre.org/adoption/participants.html
Many vendors are working on integrating Cisco IOS schemata support into their products. An example of an open source tool that supports the Cisco IOS OVAL schema is jOVAL. For more information about jOVAL visit: http://joval.org
Figure 2 shows an example of an OVAL scan results from the jOVAL open source scanner:
Figure 2 - OVAL Scan Results
The following whitepaper provides a detailed description of the SCAP components and other security automation specifications, as well as step-by-step instructions on how to use OVAL content with available open source tools:
Hi EveryoneI am trying to Create an Internal User with cURL and JSON on window command prompt for cisco ISE. prompt but I am getting these errors over again . can anyone help me outthis is curl commandcurl --insecure --include...
Hi, would anyone please explain to me how to resolve unlicensed sfr devices issue?Issue: We have registered all premium features on the FMC with Cisco PLR license, then we added SFR modules to it expecting those will be licensed as well but still not work...
I'm sure people might have come across this problem numerous times previously. However, I was unabe to get something on this page. So posting this. We have a deployment where we are turning on wired NAC with dot1x with MAB as failover. My understandi...
HiWe have bunch of Cisco ISE virtual appliance with software version 2.6 and smart license installed. We have 2 PAN & PSN (Pri & Sec) and couple of PSN. Out of this we have to move one of the PAN to new VLAN with new IP address. Please advise...
Dear community members, a customer have to regenerate a S2S-Tunnel (IKEv1) on his ASA runneing a 9.X release but the IPsec Proposal is still missing (see attached ASDM screen dump).He has still an old ASCII configuration but he cannot find a IPsec Pr...