Download Introduction to OVAL to SACM Info Model Paper

Introduction to OVAL to
SACM Info Model Paper
Matt Hansbury
Danny Haynes
May 12, 2015
Open Vulnerability and Assessment Language
• OVAL is an XML-based language for encoding details about how to assess the
state of endpoint.
• Founded in 2002 as a community-driven effort
• Operated by the MITRE Corporation on behalf of DHS
• OVAL is widely adopted
• Supported by 45 organizations, with 63 products and services, across 13 countries (lots of
running code)
• Defined as the primary checking language for the Security Content Automation Protocol
(SCAP)
• IPR Considerations
• MITRE holds trademark and copyright for OVAL, on behalf of the U.S. Department of
Homeland Security (DHS)
• DHS and MITRE are currently working on resolving
Paper Overview
• Many SACM IM components are aligned with OVAL data models
• The paper maps each of the relevant components from the IM into the
appropriate data model provided by OVAL
• Concrete recommendations, based on 10+ years of experience in
endpoint assessment, are provided as a way forward
• Finally, the paper discusses a set of relevant lessons learned through the
long running effort, along with takeaways for the SACM WG
Key Recommendations
• Use the OVAL System Characteristics Model for data collection
• Models operating system level constructs
• Some modifications and/or extensions will be needed, but, could serve as a starting
point
• Use the OVAL Definitions Model for Evaluation and Collection Guidance
• Encodes both Collection and Evaluation Guidance in a single model
• Some effort will be required to de-couple the components, but, may serve as a
starting point
• Do NOT use the OVAL Results Model for assessment results
• Never quite satisfied the community’s need for granularity or ease of use
Key Lessons Learned
• Simplicity is Key
• Ensure that the diversity of the information to be shared fits with the types of
organizations that must share it
• De-couple Collection and Evaluation
• Empower Subject Matter Experts (SMEs)
• Primary source vendors and other SMEs know best
• Provide them the means to easily and effectively convey how to do so
• Carrots Work Better than Sticks
• Rely on solid business reasons that drive vendors to adopt rather than regulatory
mandates
Next Steps
• Continue discussion on SACM mailing list
• Revise document based on feedback
• Consider implications of IPR and related issues
• Plan out schedule for contribution of actual OVAL data models
Resources
• OVAL Web Site
• OVAL and the SACM Information Model
• Security Content Automation Protocol (SCAP)