|
|
Name of Your Organization:
IBM Internet Security Systems
Web Site:
http://www.iss.net
Compatible Capability:
Server Sensor - Product requires management console (SiteProtector)
Capability home page:
http://www-935.ibm.com/services/us/index.wss/offerfamily/iss/a1029097
1) Product Accessibility <CR_2.4>
Provide a short description of how and where your capability is made available to your customers and the public (required):
Vulnerability information available within management consoel, SiteProtector. Additionally, WWW site at http://xforce.iss.net/xforce/search.php at no cost.
4) Map Currency Indication <CR_5.1>
Describe how and where your capability indicates the most recent CVE version used to create or update its mappings (required):
The information available within SiteProtector is derived from the X-Force database.
The X-Force database uses the latest CVE version available. X-Force performs reconciliation between CVE and the X-Force database using daily updates as reported from the CERIAS/Purdue University CVE-diff mailing list (CVE_diff@cerias.purdue.edu). X-Force maintains an X-Force FAQ Web page (http://xforce.iss.net/xforce/xfaq) describing the X-Force database, the current CVE version information, in addition to details of how ISS X-Force represents and updates CVE information in the X-Force Database. The CVE version is located at specifically at http://xforce.iss.net/xforce/xfaq/index.html#6.6.
5) Map Currency Update Approach <CR_5.2>
Indicate how often you plan on updating the mappings to reflect new CVE versions and describe your approach to keeping reasonably current with CVE versions when mapping them to your repository (recommended):
The X-Force database uses the daily mappings as reported from the CERIAS/Purdue University CVE-diff mailing list (CVE_diff@cerias.purdue.edu). When new CVE versions are available, ISS X-Force automatically receives daily discrepancy and change reports generated by scripts to report differences between the MITRE CVE and X-Force databases, and then X-Force researchers make appropriate adjustments to reconcile the differences. SiteProtector database is periodically updated with the new information.
6) Map Currency Update Time <CR_5.3>
Describe how and where you explain to your customers the timeframe they should expect an update of your capability's mappings to reflect a newly released CVE version (recommended):
The X-Force database team updates new CVE candidates daily, and upon notification of a new CVE version, X-Force updates the X-Force database days after a list of CVE names is available. A statement of these methods are posted on the X-Force FAQ page at http://xforce.iss.net/xforce/xfaq, specifically at http://xforce.iss.net/xforce/xfaq/index.html#6.5.
7) CVE and Compatibility Documentation<CR_4.1>
Provide a copy, or directions to its location, of where your documentation describes CVE and CVE compatibility for your customers (required):
X-Force describes CVE with respect to the X-Force Database in the X-Force FAQ document. The section describing MITRE CVE is available at http://xforce.iss.net/xforce/xfaq/index.html#6
8) Documentation of Finding Elements Using CVE Names <CR_4.2>
Provide a copy, or directions to its location, of where your documentation describes the specific details of how your customers can use CVE names to find the individual security elements within your capability's repository (required):
CVE names may be used as a search criteria from the search page at http://xforce.iss.net/xforce/search.php (enhanced database search). The description and procedures have been documented at http://xforce.iss.net/xforce/xfaq/index.html#6.8.
9) Documentation of Finding CVE Names Using Elements <CR_4.3>
Provide a copy, or directions to its location, of where your documentation describes the process a user would follow to find the CVE names associated with individual security elements within your capability's repository (required):
CVE names may be used from the search page at http://xforce.iss.net/xforce/search.php (enhanced database search). The description and procedures have been documented at http://xforce.iss.net/xforce/xfaq/index.html#6.8.
11) Candidates Versus Entries Indication <CR_6.1>
If CVE candidates are supported or used, explain how you indicate that candidates are not accepted CVE entries (required):
The X-Force database uses CVE candidate (CAN) names. There are two instances where CVE entries may not be accepted:
- If the CVE candidate has not yet been promoted to a CVE name, then the CAN- prefix is used for all candidates to differentiate them from CVE entries that use the CVE- prefix.
- If a CVE candidate is rejected and MITRE notes this fact in the description, then the X-Force database will display the same description provided by MITRE. However, because our customers often search for all types of CVE names, including those that are unaccepted or rejected, there are no plans to remove or alter CVE names further than updating the description. The X-Force FAQ at http://xforce.iss.net/xforce/xfaq/index.html#6.9 describes how we handle special CVE names, including reserved and rejected names.
12) Candidates Versus Entries Explanation <CR_6.2>
If CVE candidates are supported or used, explain where and how the difference between candidates and entries is explained to your customers (recommended):
The X-Force FAQ page describes the differences between CVE names and candidates at http://xforce.iss.net/xforce/xfaq/index.html#6.2.
13) Candidate to Entry Promotion <CR_6.3>
If CVE candidates are supported or used, explain your policy for changing candidates into entries within your capability and describe where and how this is communicated to your customers (recommended):
X-Force uses discrepancy and change reports to identify which CVE names need to be addressed, changed, or reconciled. These reports are generated by daily runs of script-based processes. A daily run after MITRE issues a Final Decision list for a given CVE version will usually result in a large list of actions, and the resultant work can typically be completed in a few days, depending on current workload and the number of promoted candidates. Products that use the X-Force Database uptake the updated information at the next major product version release, or during the next applicable update. A summary of this policy is available at http://xforce.iss.net/xforce/xfaq/index.html#6.5 and http://xforce.iss.net/xforce/xfaq/index.html#6.6.
14) Candidate and Entry Search Support <CR_6.4>
If CVE candidates are supported or used, explain where and how a customer can find the explanation of your search function's ability to look for candidates and entries by using just the YYYY-NNNN portion of the CVE names (recommended):
The X-Force database search engine supports partial matches of the form YYYY-NNNN. The documentation describing this capability is available at http://xforce.iss.net/xforce/xfaq/index.html#6.8.
15) Search Support for Promoted Candidates <CR_6.5>
If CVE candidates are supported or used, explain where and how a customer can find the explanation of your search function's support for retrieving the CVE entry for a candidate that is no longer a candidate (recommended):
The X-Force database and its search engine do not support cross-checking when the entire CVE or candidate name is provided. X-Force recommends that users search on partial matches of the form YYYY-NNNN. Because X-Force uses automated processes to update CVE names on a daily basis, the promotion of a candidate to CVE status usually displays the update in a matter of hours (for daily updates) or days (for mass-changes such as CVE Final Decisions). The documentation describing this capability is available at http://xforce.iss.net/xforce/xfaq/index.html#6.8.
16) Candidate Mapping Currency Indication <CR_6.6>
If CVE candidates are supported or used, explain where and how you tell your users how up-to-date your candidate information is (recommended):
The X-Force FAQ page describes that we strive to maintain complete alignment with CVE (http://xforce.iss.net/xforce/xfaq/index.html#6.6) and perform daily updates (http://xforce.iss.net/xforce/xfaq/index.html#6.5). Specifically, we use daily updates from the CERIAS/Purdue CVE-diff mailing list and automated processes to keep the MITRE and X-Force databases synchronized for all CVE names and candidates.
Type-Specific Capability Questions
17) Finding Tasks Using CVE Names <CR_A.2.1>
Give detailed examples and explanations of how a user can locate tasks in the tool by looking for their associated CVE name (required):
The SiteProtector console supports full-text searches for vulnerability information, including CVE references. Each vulnerability with a corresponding CVE has an associated "help" page which contains remediation information for that vulnerability.
18) Finding CVE Names Using Elements in Reports <CR_A.2.2>
Give detailed examples and explanations of how, for reports that identify individual security elements, the tool allows the user to determine the associated CVE names for the individual security elements in the report (required):
Each event has associated signature/vulnerability information that is presented to the user as HTML help. Attached are examples of the HTLM help, as well as screen shots of the UI.
31) Electronic Document Format Info <CR_B.3.1>
Provide details about the different electronic document formats that you provide and describe how they can be searched for specific CVE-related text (required):
Vulnerability information is presented in HTML form and can be searched using the full-text search mechanism in the GUI.
32) Electronic Document Listing of CVE Names <CR_B.3.2>
If one of the capability's standard electronic documents only lists security elements by their short names or titles provide example documents that demonstrate how the associated CVE names are listed for each individual security element (required):
34) Finding Elements Using CVE Names Through the GUI <CR_B.4.1>
Give detailed examples and explanations of how the GUI provides a "find" or "search" function for the user to identify your capability's elements by looking for their associated CVE name(s) (required):
The Microsoft HTML Help viewer allows for full-text searches. The user may search for an element using the CVE name.
35) GUI Element to CVE Name Mapping <CR_B.4.2>
Briefly describe how the associated CVE names are listed for the individual security elements or discuss how the user can use the mapping between CVE entries and the capability's elements, also describe the format of the mapping (required):
CVE names are listed under the "CVE Reference(s)" section in the check help.
36) GUI Export Electronic Document Format Info <CR_B.4.3>
Provide details about the different electronic document formats that you provide for exporting or accessing CVE-related data and describe how they can be searched for specific CVE-related text (recommended):
The information supplied for the X-Force Database also applies here, as the vulnerability information provided in the SiteProtector database is derived from the X-Force Database.
37) Statement of Compatibility <CR_2.7>
Have an authorized individual sign and date the following Compatibility Statement (required):
"As an authorized representative of my organization I agree that we will abide by all of the mandatory CVE Compatibility Requirements as well as all of the additional mandatory CVE Compatibility Requirements that are appropriate for our specific type of capability."
Name: David Abercrombie
Title: Product Manager - Server Protection
38) Statement of Accuracy <CR_3.4>
Have an authorized individual sign and date the following accuracy Statement (recommended):
"As an authorized representative of my organization and to the best of my knowledge, there are no errors in the mapping between our capability's Repository and the CVE entries our capability identifies."
Name: Luanne Johnson
Title: Team Lead for the X-Force database
39) Statement on False-Positives and False-Negatives <CR_A.2.8 and/or CR_A.3.5>
FOR TOOLS ONLY - Have an authorized individual sign and date the following statement about your tools efficiency in identification of security elements (required):
"As an authorized representative of my organization and to the best of my knowledge, normally when our capability reports a specific security element, it is generally correct and normally when an event occurs that is related to a specific security element our capability generally reports it."
Name: Luanne Johnson
Title: Team Lead for the X-Force database