Name of Your Organization:
Trend Micro, Inc.
Web Site:
www.trendmicro.com
Compatible Capability:
Trend Micro Vulnerability Assessment
Capability home page:
www.trendmicro.com/advisory
1) Product Accessibility <CR_2.4>
Provide a short description of how and where your capability is made available to your customers and the public (required):
After customers avail of the Trend Micro Vulnerability Assessment (TMVA) service, they are sent a CD with the appropriate license keys to get them started. The customer can simply call sales for additional software licenses, when the need arises.
An evaluation copy of the Trend Micro Vulnerability Assessment is also available from the following site:
http://www.trendmicro.com/en/products/eps/services/overview.htm#va
4) Map Currency Indication <CR_5.1>
Describe how and where your capability indicates the most recent CVE version used to create or update its mappings (required):
A weekly verification scheme is in place, which covers changes that may have been made in the CVE database. This is done by monitoring the new/modified CVE entries via the CVE mailing list. The CVE version currently in use is a part of the release notes.
5) Map Currency Update Approach <CR_5.2>
Indicate how often you plan on updating the mappings to reflect new CVE versions and describe your approach to keeping reasonably current with CVE versions when mapping them to your repository (recommended):
Both assessment pattern and information database are updated to add/modify a pattern and information database entry pertaining to a Critical vulnerability included in newly released security bulletins from Microsoft.
So as to ensure that entries contained in previous versions are up-to-date, a verification process done on a weekly basis is in place to replace outdated information with current ones.
6) Map Currency Update Time <CR_5.3>
Describe how and where you explain to your customers the timeframe they should expect an update of your capability's mappings to reflect a newly released CVE version (recommended):
Trend Micro Control Manager, which contains the Trend Micro Vulnerability Assessment module, provides administrators the option to enable a notification feature that will inform them of newly released assessment patterns.
7) CVE and Compatibility Documentation<CR_4.1>
Provide a copy, or directions to its location, of where your documentation describes CVE and CVE compatibility for your customers (required):
Trend Micro provides users a detailed explanation of CVE and CVE compatibility on the following page:
8) Documentation of Finding Elements Using CVE Names <CR_4.2>
Provide a copy, or directions to its location, of where your documentation describes the specific details of how your customers can use CVE names to find the individual security elements within your capability's repository (required):
The report generated by TMVA whenever a vulnerability is detected on a machine includes a column that lists the corresponding CVE Name/Number for the reported vulnerability. Hence, documentation on how to find the corresponding CVE Name/Number for a vulnerability is unnecessary.
As for the online capability, the following URL will contain details on how the user could utilize the CVE Name/Number in searching for specific vulnerabilities:
9) Documentation of Finding CVE Names Using Elements <CR_4.3>
Provide a copy, or directions to its location, of where your documentation describes the process a user would follow to find the CVE names associated with individual security elements within your capability's repository (required):
The report generated by TMVA whenever a vulnerability is detected on a machine includes a column that lists the corresponding CVE Name/Number for the reported vulnerability. Hence, documentation on how to find the corresponding CVE Name/Number for a vulnerability is unnecessary.
As for the online capability, the following URL will contain details on how the user could utilize the CVE Name/Number in searching for specific vulnerabilities:
11) Candidates Versus Entries Indication <CR_6.1>
If CVE candidates are supported or used, explain how you indicate that candidates are not accepted CVE entries (required):
Candidates uses the CAN prefix, while accepted entries use the CVE prefix. In the following URL, users are asked to go to a specific CVE site for the details on how these two are different:
12) Candidates Versus Entries Explanation <CR_6.2>
If CVE candidates are supported or used, explain where and how the difference between candidates and entries is explained to your customers (recommended):
In the following URL, users are asked to go to a specific CVE site for the details on how these two are different:
13) Candidate to Entry Promotion <CR_6.3>
If CVE candidates are supported or used, explain your policy for changing candidates into entries within your capability and describe where and how this is communicated to your customers (recommended):
A weekly verification scheme is in place, which covers such changes as the upgrade of CVE candidates to official CVE entry status. Customers are not explicitly told of the changes, but the changes will be reflected on the new information database that will be released.
Again, Trend Micro Control Manager, which contains the Trend Micro Vulnerability Assessment module, comes with an option so that the administrator will be notified whenever there is a new vulnerability assessment pattern available.
14) Candidate and Entry Search Support <CR_6.4>
If CVE candidates are supported or used, explain where and how a customer can find the explanation of your search function's ability to look for candidates and entries by using just the YYYY-NNNN portion of the CVE names (recommended):
The following URL indicates the different CVE-related search tips the user could employ:
15) Search Support for Promoted Candidates <CR_6.5>
If CVE candidates are supported or used, explain where and how a customer can find the explanation of your search function's support for retrieving the CVE entry for a candidate that is no longer a candidate (recommended):
The following URL indicates the different CVE-related search tips the user could employ:
16) Candidate Mapping Currency Indication <CR_6.6>
If CVE candidates are supported or used, explain where and how you tell your users how up-to-date your candidate information is (recommended):
Both assessment pattern and information database comes with a version number, which are incremented with each update. Although there are several reasons for releasing a newer version, a need to update the vulnerability information database is one of the reasons why a newer version of both assessment pattern and information database is being released.
Type-Specific Capability Questions
17) Finding Tasks Using CVE Names <CR_A.2.1>
Give detailed examples and explanations of how a user can locate tasks in the tool by looking for their associated CVE name (required):
The next version of Trend Micro Vulnerability Assessment will include a feature that will list down all the vulnerabilities included in the current pattern, from which the user could choose the task(s) to implement. Although the tasks name will be using the corresponding MS-ID associated with the vulnerability, the corresponding CVE entry for each MS-ID will be properly indicated.
18) Finding CVE Names Using Elements in Reports <CR_A.2.2>
Give detailed examples and explanations of how, for reports that identify individual security elements, the tool allows the user to determine the associated CVE names for the individual security elements in the report (required):
In the detailed report produced by TMVA, a column called CVE/CAN Number shows the CVE or CAN number(s), which correspond with each vulnerability detected in the machine.
Service Questions
23) Service Coverage Determination Using CVE Names <CR_A.3.1>
Give detailed examples and explanations of the different ways that a user can use CVE names to find out which security elements are tested or detected by the service (i.e. by asking, by providing a list, by examining a coverage map, or by some other mechanism) (required):
Each vulnerability detected by TMVA is compiled in a report, wherein each vulnerability come with the CVE/CAN information that corresponds to it.
Here's a sample report:
24) Finding CVE Names in Service Reports Using Elements <CR_A.3.2>
Give detailed examples and explanations of how, for reports that identify individual security elements, the user can determine the associated CVE names for the individual security elements in the report (required):
CVE/CAN info of a particular vulnerability is included in the report by default, as can be seen in the sample report in (23).
26) Finding Online Capability Tasks Using CVE Names <CR_A.4.1>
Give detailed examples and explanations of how a "find" or "search" function is available to the user to locate tasks in the online capability by looking for their associated CVE name or through an online mapping that links each element of the capability with its associated CVE name(s) (required):
The following URL indicates the different CVE-related search tips the user could employ:
29) Finding CVE Names Using Online Capability Elements <CR_A.4.2>
Give detailed examples and explanations of how, for reports that identify individual security elements, the online capability allows the user to determine the associated CVE names for the individual security elements in the report (required):
The information provided for each vulnerability at the www.trendmicro.com/advisory includes a field called Vulnerability Identifier. The said field could contain identifiers used for a specific vulnerability, which includes the CVE name.
31) Electronic Document Format Info <CR_B.3.1>
Provide details about the different electronic document formats that you provide and describe how they can be searched for specific CVE-related text (required):
The vulnerability assessment process related to TMVA is done through a web-based console called Trend Micro Control Manager. Thus, users could use the web browser's search feature to look for a specific CVE name from the report output of TMVA.
32) Electronic Document Listing of CVE Names <CR_B.3.2>
If one of the capability's standard electronic documents only lists security elements by their short names or titles provide example documents that demonstrate how the associated CVE names are listed for each individual security element (required):
CVE/CAN info of a particular vulnerability is included in the report by default, as can be seen in the sample report in (23).
33) Electronic Document Element to CVE Name Mapping <CR_B.3.3>
Provide example documents that demonstrate the mapping from the capability's individual elements to the respective CVE name(s) (recommended):
The sample report in (23) shows that every vulnerability included in the report has a corresponding CVE/CAN info under the CVE/CAN Number.
34) Finding Elements Using CVE Names Through the GUI <CR_B.4.1>
Give detailed examples and explanations of how the GUI provides a "find" or "search" function for the user to identify your capability's elements by looking for their associated CVE name(s) (required):
The vulnerability assessment process related to TMVA is done through a web-based console called Trend Micro Control Manager. Thus, users could use the web browser's search feature to look for a specific CVE name from the report output of TMVA.
35) GUI Element to CVE Name Mapping <CR_B.4.2>
Briefly describe how the associated CVE names are listed for the individual security elements or discuss how the user can use the mapping between CVE entries and the capability's elements, also describe the format of the mapping (required):
The sample report in (23) shows that for every vulnerability listed, a corresponding CVE/CAN number is also provided. Each vulnerability (in rows) is differentiated with a change in the background color, making the corresponding CVE/CAN name easily distinguishable.
37) Statement of Compatibility <CR_2.7>
Have an authorized individual sign and date the following Compatibility Statement (required):
"As an authorized representative of my organization I agree that we will abide by all of the mandatory CVE Compatibility Requirements as well as all of the additional mandatory CVE Compatibility Requirements that are appropriate for our specific type of capability."
Name: John Hermano
Title: Global Product Manager
38) Statement of Accuracy <CR_3.4>
Have an authorized individual sign and date the following accuracy Statement (recommended):
"As an authorized representative of my organization and to the best of my knowledge, there are no errors in the mapping between our capability's Repository and the CVE entries our capability identifies."
Name: John Hermano
Title: Global Product Manager
39) Statement on False-Positives and False-Negatives <CR_A.2.8 and/or CR_A.3.5>
FOR TOOLS ONLY - Have an authorized individual sign and date the following statement about your tools efficiency in identification of security elements (required):
"As an authorized representative of my organization and to the best of my knowledge, normally when our capability reports a specific security element, it is generally correct and normally when an event occurs that is related to a specific security element our capability generally reports it."
Name: John Hermano
Title: Global Product Manager
