|
|
Name of Your Organization:
DragonSoft Security Associates, Inc.
Web Site:
http://www.dragonsoft.com
Compatible Capability:
DragonSoft Secure Scanner
Capability home page:
http://www.dragonsoft.com/product/index_dss.php
1) Product Accessibility <CR_2.4>
Provide a short description of how and where your capability is made available to your customers and the public (required):
The DragonSoft Secure Scanner is provided through software agencies and vendors to our customers. It is the first in similar products which provides a complete traditional Chinese interface. Customers can find information about our partner vendors at the following URL.http://www.dragonsoft.com/partner/
There is a 15-days evaluation version of the capability provided to the public for free. One can download it on our website at the following URL.
http://www.dragonsoft.com/download/
In addition to the software program, we provide a complete vulnerabilities and exposures database on our web site. The database is maintained consistently with the one used in our product. The web page provides convenient interface to customers as well as the public to search/browse vulnerabilities and exposures information.
4) Map Currency Indication <CR_5.1>
Describe how and where your capability indicates the most recent CVE version used to create or update its mappings (required):
When an entry with corresponding CVE name is shown, the most recent CVE version used to update this mapping is shown. An example is shown below.
5) Map Currency Update Approach <CR_5.2>
Indicate how often you plan on updating the mappings to reflect new CVE versions and describe your approach to keeping reasonably current with CVE versions when mapping them to your repository (recommended):
We had updated the repository according to newest version of CVE list. CVE candidates are also used. Specific technician keeps monitor the changes of CVE list and modify the repository accordingly.
7) CVE and Compatibility Documentation<CR_4.1>
Provide a copy, or directions to its location, of where your documentation describes CVE and CVE compatibility for your customers (required):
Web Pages:
We describe the effort we made for the capability to be listed as CVE compatible product.
http://www.dragonsoft.com/ournews/2003-11-06.php
The CVE output is listed as a product function on the description of the capability.
http://www.dragonsoft.com/english/SecureScanner/spec.php - English
http://www.dragonsoft.com/product/index_dss.php - traditional ChineseProduct Brochure:
We state that the capability uses the CVE name in program output in our online product description brochures.
http://www.dragonsoft.com/SecureScanner/DSS.pdf - traditional Chinese version
http://www.dragonsoft.com/english/SecureScanner/DS_Scan_E.pdf - English versionUser Manual:
The user manual of the capability includes description of CVE and CVE compatibility. The section describing CVE is listed below.
On-line Help:
The on-line help provided within the capability describes CVE with the same text as in the user manual.
8) Documentation of Finding Elements Using CVE Names <CR_4.2>
Provide a copy, or directions to its location, of where your documentation describes the specific details of how your customers can use CVE names to find the individual security elements within your capability's repository (required):
The element search function is provided on our web page without explicit documentation.
9) Documentation of Finding CVE Names Using Elements <CR_4.3>
Provide a copy, or directions to its location, of where your documentation describes the process a user would follow to find the CVE names associated with individual security elements within your capability's repository (required):
The on-line help describes that CVE name is associated with an element in a generated report.
11) Candidates Versus Entries Indication <CR_6.1>
If CVE candidates are supported or used, explain how you indicate that candidates are not accepted CVE entries (required):
The CVE candidates are used as well as accepted entries in the capability. Customers can distinguish CVE candidates from accepted CVE entries according to the prefixes of entry names (CAN- for candidates, CVE- for accepted entries). The CVE name and associate link to MITRE CVE web page is provided. Customers can use the link to check further information about the specific entry.
13) Candidate to Entry Promotion <CR_6.3>
If CVE candidates are supported or used, explain your policy for changing candidates into entries within your capability and describe where and how this is communicated to your customers (recommended):
When new CVE version is released, the candidates that change into accepted entries are updated in the repository. The name of such an entry is changed according to the new version. Customers can identify the change through entry name prefix.
Type-Specific Capability Questions
17) Finding Tasks Using CVE Names <CR_A.2.1>
Give detailed examples and explanations of how a user can locate tasks in the tool by looking for their associated CVE name (required):
The user can choose different audit task from program menu(tool) ->
(policy), then choose
(audit) from the left panel. The items shown on the right panel includes only brief description only, though. The user needs to check for CVE name for specific audit through the vulnerability/exposure database on our web site.
18) Finding CVE Names Using Elements in Reports <CR_A.2.2>
Give detailed examples and explanations of how, for reports that identify individual security elements, the tool allows the user to determine the associated CVE names for the individual security elements in the report (required):
When the scan process finishes, the result is displayed. All vulnerabilities and exposures detected are included in the list.
For a complete report, click the menu item "
(Report)".
Select the report format. In the "
(Section)" list box, the "
Choose the IP addresses to be included in the report. Then press "
(OK)" button.
The report file generated is in HTML format. Use a web browser or HTML viewer to examine the report.
The vulnerabilities/exposures section layout is the same as the output generated by the online database. The CVE name is listed at the bottom line of each entry.
31) Electronic Document Format Info <CR_B.3.1>
Provide details about the different electronic document formats that you provide and describe how they can be searched for specific CVE-related text (required):
Product description brochures:
PDF format, can be download from the following urls.
http://www.dragonsoft.com/SecureScanner/DSS.pdf - traditional Chinese
http://www.dragonsoft.com/SecureScanner/DS_Scan_E.pdf - English
They can be view/search with free Adobe Acrobat Reader Software.User Manual:
PDF format. You can download it from the following url.
http://www.dragonsoft.com/FAQ/DSS20031216.zipOnline Help:
Compressed HTML Help File. This is the standard help file format used by Microsoft Windows 98 and above. Windows operating system contains the hh.exe (HTML Help) viewer. The search function can be used to search specific keyword. The screen shots below show CVE-related information in the help file. Search for cve. Three results shown.
The first item describes CVE name referenced in generated report.
This is the description of the capability. The last paragraph describes the CVE naming scheme and the effort we made to be CVE compatible.
The capability allows users define their own audit type (a security item). This page of online help describes how to made an audit, CVE name can be included in the new audit.
32) Electronic Document Listing of CVE Names <CR_B.3.2>
If one of the capability's standard electronic documents only lists security elements by their short names or titles provide example documents that demonstrate how the associated CVE names are listed for each individual security element (required):
The capability provides no document for individual security element.
34) Finding Elements Using CVE Names Through the GUI <CR_B.4.1>
Give detailed examples and explanations of how the GUI provides a "find" or "search" function for the user to identify your capability's elements by looking for their associated CVE name(s) (required):
The search function is provided through web page. Please access the online vulnerabilities/exposures database through the following hyper links.
http://www.dragonsoft.com/vulner/ for traditional Chinese
http://www.dragonsoft.com/english/vulner/ for English
We use the English version to demonstrate here.
Input the CVE name of the entry you are looking for.
Press enter key after finish typing or click on the "Send Query" button.
The corresponding entry is displayed if a match is found. For detail information about the specific entry, clink on the "Name" field.
The detail information is shown. Scroll down to find the corresponding CVE name.
Click on the CVE name to navigate to the description page on CVE web site.
35) GUI Element to CVE Name Mapping <CR_B.4.2>
Briefly describe how the associated CVE names are listed for the individual security elements or discuss how the user can use the mapping between CVE entries and the capability's elements, also describe the format of the mapping (required):
After the scan process finishes, the result is displayed. All vulnerabilities and exposures detected are included in the list.
Click on a particular entry shows the detail information about the vulnerability/exposure.
In the description panel, scroll down to find the corresponding CVE name.
36) GUI Export Electronic Document Format Info <CR_B.4.3>
Provide details about the different electronic document formats that you provide for exporting or accessing CVE-related data and describe how they can be searched for specific CVE-related text (recommended):
The capability generates report file in HTML format. If a vulnerability or exposure is found, the entry in the report includes the CVE name that is associated with. One can search for the CVE name using the search/find function provided by the web browser.
37) Statement of Compatibility <CR_2.7>
Have an authorized individual sign and date the following Compatibility Statement (required):
"As an authorized representative of my organization I agree that we will abide by all of the mandatory CVE Compatibility Requirements as well as all of the additional mandatory CVE Compatibility Requirements that are appropriate for our specific type of capability."
Name: Ming-Jye Tsai
Title: CEO
38) Statement of Accuracy <CR_3.4>
Have an authorized individual sign and date the following accuracy Statement (recommended):
"As an authorized representative of my organization and to the best of my knowledge, there are no errors in the mapping between our capability's Repository and the CVE entries our capability identifies."
Name: Ming-Jye Tsai
Title: CEO
39) Statement on False-Positives and False-Negatives <CR_A.2.8 and/or CR_A.3.5>
FOR TOOLS ONLY - Have an authorized individual sign and date the following statement about your tools efficiency in identification of security elements (required):
"As an authorized representative of my organization and to the best of my knowledge, normally when our capability reports a specific security element, it is generally correct and normally when an event occurs that is related to a specific security element our capability generally reports it."
Name: Ming-Jye Tsai
Title: CEO