Name of Your Organization:

GFI Software Ltd.

Web Site:

www.gfi.com

Compatible Capability:

GFI LANguard Network Security Scanner

Capability home page:

http://www.gfi.com/lannetscan/

1) Product Accessibility <CR_2.4>

Provide a short description of how and where your capability is made available to your customers and the public (required):

Product can be downloaded from our web site http://www.gfi.com/lannetscan

4) Map Currency Indication <CR_5.1>

Describe how and where your capability indicates the most recent CVE version used to create or update its mappings (required):

At GFI, we use the CVE reference maps at http://cve.mitre.org/cve/refs/refmap/ in order to map vulnerabilities from other sources such as OVAL to CVE IDs. Since these maps are based on CVE version 20061101 along with the latest candidate data, these are the versions that we currently support. Should a new version come out, it will be supported automatically as we import the new data to our vulnerability databases.

5) Map Currency Update Approach <CR_5.2>

Indicate how often you plan on updating the mappings to reflect new CVE versions and describe your approach to keeping reasonably current with CVE versions when mapping them to your repository (recommended):

The CVE mappings are updated every time we release an update to the Vulnerability and Patch Management databases. This is because as part of the process, the software we use to update the databases, refers to the latest reference maps at http://cve.mitre.org/cve/refs/refmap/ and uses them to update the mappings in the database. The Patch Management database is updated on every Microsoft patch Tuesday, and also when other important updates come out, while the Vulnerability database is updated when new OVAL definitions are published.

6) Map Currency Update Time <CR_5.3>

Describe how and where you explain to your customers the timeframe they should expect an update of your capability's mappings to reflect a newly released CVE version (recommended):

GFI LANguard Network Security Scanner is being marketed as being updated once a month or more frequently. This is when the CVE mappings are updated.

7) CVE and Compatibility Documentation<CR_4.1>

Provide a copy, or directions to its location, of where your documentation describes CVE and CVE compatibility for your customers (required):

The CVE compatability documentation forms part of the user manual which can be opened from the main application by pressing F1. CVE documentation can be found in chapter 9. Scanning Profiles in sections "About CVE" and "About CVE Compatability".

8) Documentation of Finding Elements Using CVE Names <CR_4.2>

Provide a copy, or directions to its location, of where your documentation describes the specific details of how your customers can use CVE names to find the individual security elements within your capability's repository (required):

Details can be found in the user manual, in chapter 9. Scanning profile, section "Searching for CVE entries in GFI LANguard N.S.S.".

9) Documentation of Finding CVE Names Using Elements <CR_4.3>

Provide a copy, or directions to its location, of where your documentation describes the process a user would follow to find the CVE names associated with individual security elements within your capability's repository (required):

Details can be found in the user manual, in chapter 9. Scanning profile, section "Obtaining CVE names".

10) Documentation Indexing of CVE-Related Material <CR_4.4>

If your documentation includes an index, provide a copy of the items and resources that you have listed under "CVE" in your index. Alternately, provide directions to where these "CVE" items are posted on your web site (recommended):

In the user documentation in Chapter 9. Scanning Profiles, a number of sections regarding CVE can be found. These include the following:

• About CVE
• About CVE Compatibility
• About CVE and CAN
• Searching for CVE entries in GFI LANguard N.S.S.
• Obtaining CVE names
• Importing and exporting CVE Data

11) Candidates Versus Entries Indication <CR_6.1>

If CVE candidates are supported or used, explain how you indicate that candidates are not accepted CVE entries (required):

Along with the CVE ID list, the GUI contains a button, which when clicked, opens the CVE urls in the user's web browser. The user can see whether the CVE entry is accepted or is a candidate by viewing the web page.

12) Candidates Versus Entries Explanation <CR_6.2>

If CVE candidates are supported or used, explain where and how the difference between candidates and entries is explained to your customers (recommended):

Details can be found in the user manual, in chapter 9. Scanning profile, section "About CVE and CAN".

13) Candidate to Entry Promotion <CR_6.3>

If CVE candidates are supported or used, explain your policy for changing candidates into entries within your capability and describe where and how this is communicated to your customers (recommended):

Since the way in which the user can see whether a CVE entry is a candidate or is accepted depends on the user viewing the web page which is hosted on the MITRE website, this is updated automatically.

14) Candidate Mapping Currency Indication <CR_6.6>

If CVE candidates are supported or used, explain where and how a customer can find the explanation of your search function's ability to look for candidates and entries by using just the YYYY-NNNN portion of the CVE names (recommended):

Since the candidate/accepted status must be read from the MITRE web page, it is automatically implied that this is always up to date.

Type-Specific Capability Questions

15) Finding Tasks Using CVE Names <CR_A.2.1>

Give detailed examples and explanations of how a user can locate tasks in the tool by looking for their associated CVE name (required):

The search functionality is provided in the Vulnerabilities tab in the Configuration area. Here, the user can search using different criteria including vulnerability name, and CVE ID.

In order to search for any CVE ID, the user should do the following:

• In the GFI LANguard N.S.S. window, from the tools explorer, select the Configuration tab.
• Select the required Scanning Profile.
• Select the Vulnerabilities tab from the right pane.
• In the bottom-left area, look for the "Find vulnerability" label.
• From the drop-down list, select "by CVE ID".
• Enter the required CVE ID in the text box and click find.
• If the CVE ID is found, the corresponding vulnerability in the list will be highlighted.

16) Finding CVE Names Using Elements in Reports <CR_A.2.2>

Give detailed examples and explanations of how, for reports that identify individual security elements, the tool allows the user to determine the associated CVE names for the individual security elements in the report (required):

Upon executing a scan, the scan results are displayed in the right pane. In order to obtain the CVE ID of a vulnerability that is listed in the results, the user should double-click on the vulnerability name, and from the "Edit vulnerability" dialog box that appears, select the "References" tab. The CVE ID is shown as one of the references.

17) Getting a List of CVE Names Associated with Tasks <CR_A.2.4>

Give detailed examples and explanations of how a user can obtain a listing of all of the CVE names that are associated with the tool's tasks (recommended):

In GFI LANguard N.S.S., the user should select the Configuration tab from the Tools Explorer. The user can then select the Scanning Profile that will be used for scanning. The Vulnerabilities tab should then be selected from the main pane. All supported vulnerabilities are listed along with their respecive CVE IDs. The list can be sorted by CVE ID by clicking on the CVE ID column title.

Apart from viewing the list of vulnerabilities, the user may double- click on any of the listed vulnerabilities, and in the "Edit vulnerability" dialog box, select the References tab.

18) Selecting Tasks with a List of CVE Names <CR_A.2.5>

Describe the steps and format that a user would use to select a set of tasks by providing a file with a list of CVE names (recommended):

This method of importing a list of CVE names from a file is not supported as other more user-friendly methods are being provided (see question 19).

19) Selecting Tasks Using Individual CVE Names <CR_A.2.6>

Describe the steps that a user would follow to browse, select, and deselect a set of tasks for the tool by using individual CVE names (recommended):

In GFI LANguard N.S.S., the user should select the Configuration tab from the Tools Explorer. The user should then right click on "Scanning Profiles" and from the menu select New > Scan Profile. The user should then write a custom name as a Profile name, and select "Vulnerability Scanning" as Profile category. The user should then select the Vulnerabilities tab from the main pane. The vulnerability list can be sorted by CVE ID by clicking on the CVE ID column title. The user can then select individual vulnerabilities by using the checkboxes near every item in the list.

20) Non-Support Notification for a Requested CVE Name <CR_A.2.7>

Provide a description of how the tool notifies the user that task associated to a selected CVE name cannot be performed (recommended):

If the user tries to search for a CVE ID that is not present in GFI LANguard N.S.S., a message box appears, with the text "No vulnerabilites were found that match your criteria".

29) Electronic Document Format Info <CR_B.3.1>

Provide details about the different electronic document formats that you provide and describe how they can be searched for specific CVE-related text (required):

The scan results can be exported to XML. This can be done by right- clicking in the Scanned Computers pane, and selecting "Save scan results to XML file".

The output XML file contains a node with CVE IDs for every vulnerability found. This file can either be parsed using a custom parser, or else can be opened using any application that formats XML into human-readable format, such as Internet Explorer, and use that application's features to search for CVE IDs.

30) Electronic Document Listing of CVE Names <CR_B.3.2>

If one of the capability's standard electronic documents only lists security elements by their short names or titles provide example documents that demonstrate how the associated CVE names are listed for each individual security element (required):

This feature is not required in GFI LANguard N.S.S. because vulnerabilities are listed along with their full details.

31) Electronic Document Element to CVE Name Mapping <CR_B.3.3>

Provide example documents that demonstrate the mapping from the capability's individual elements to the respective CVE name(s) (recommended):

GFI LANguard N.S.S. uses mappings from the CVE site. For example, in order to map OVAL IDs with CVE IDs, the map at http://cve.mitre.org/cve/refs/refmap/source-OVAL.html is used. GFI LANguard does not download these pages directly, but they are imported and processed by GFI in order to create a complete database for the users.

If it is required to view the complete mapping that is used internally by LANguard N.S.S., this can be found in the mdb file located in <LANguard N.S.S. directory>\Data\ operationsprofiles.mdb. The table named VulnerabilityDefinitions contains all the mappings between the Vulnerability names, CVE IDs, MS Bulletin IDs, etc.

32) Finding Elements Using CVE Names Through the GUI <CR_B.4.1>

Give detailed examples and explanations of how the GUI provides a "find" or "search" function for the user to identify your capability's elements by looking for their associated CVE name(s) (required):

The search functionality is provided in the Vulnerabilities tab in the Configuration area. Here, the user can search using different criteria including vulnerability name, and CVE ID.

In order to search for any CVE ID, the user should do the following:

• In the GFI LANguard N.S.S. window, from the tools explorer, select the Configuration tab.
• Select the required Scanning Profile.
• Select the Vulnerabilities tab from the right pane.
• In the bottom-left area, look for the "Find vulnerability" label.
• From the drop-down list, select "by CVE ID".
• Enter the required CVE ID in the text box and click find.
• If the CVE ID is found, the corresponding vulnerability in the list will be highlighted.

33) GUI Element to CVE Name Mapping <CR_B.4.2>

Briefly describe how the associated CVE names are listed for the individual security elements or discuss how the user can use the mapping between CVE entries and the capability's elements, also describe the format of the mapping (required):

In GFI LANguard N.S.S., the user should select the Configuration tab from the Tools Explorer. The user can then select the Scanning Profile that will be used for scanning. The Vulnerabilities tab should then be selected from the main pane. All supported vulnerabilities are listed along with their respecive CVE IDs. The list can be sorted by CVE ID by clicking on the CVE ID column title.

The user can then double click on any of the listed vulnerabilities, and in the "Edit vulnerability" dialog box, select the References tab. This shows the mapping between all supported references for that specific vulnerability.

34) GUI Export Electronic Document Format Info <CR_B.4.3>

The scan results can be exported to an XML file that can be parsed using a custom parser or viewed in a web browser. Details how this can be done can be found in the answer to question 29.

35) Statement of Compatibility <CR_2.7>

Have an authorized individual sign and date the following Compatibility Statement (required):

"As an authorized representative of my organization I agree that we will abide by all of the mandatory CVE Compatibility Requirements as well as all of the additional mandatory CVE Compatibility Requirements that are appropriate for our specific type of capability."

Name: Andre' Muscat

Title: Director of Engineering

36) Statement of Accuracy <CR_3.4>

Have an authorized individual sign and date the following accuracy Statement (recommended):

"As an authorized representative of my organization and to the best of my knowledge, there are no errors in the mapping between our capability's Repository and the CVE entries our capability identifies."

Name: Andre' Muscat

Title: Director of Engineering

37) Statement on False-Positives and False-Negatives <CR_A.2.8 and/or CR_A.3.5>

FOR TOOLS ONLY - Have an authorized individual sign and date the following statement about your tools efficiency in identification of security elements (required):

"As an authorized representative of my organization and to the best of my knowledge, normally when our capability reports a specific security element, it is generally correct and normally when an event occurs that is related to a specific security element our capability generally reports it."

Name: Andre' Muscat

Title: Director of Engineering