|
|
Name of Your Organization:
netVigilance Inc.
Web Site:
http://www.netvigilance.com
Compatible Capability:
SecureScout Perimeter
Capability home page:
http://www.netvigilance.com/html/perimeter.htm
1) Product Accessibility <CR_2.4>
Provide a short description of how and where your capability is made available to your customers and the public (required):
Free evaluations are available from our website;
http://www.netvigilance.com/nx-trial.htm
Or by calling our office: 503-524-5758
4) Map Currency Indication <CR_5.1>
Describe how and where your capability indicates the most recent CVE version used to create or update its mappings (required):
The database; updated weekly indicates the current CVE version level. This information is also included in the weekly update release notes and on our website:
http://descriptions.securescout.com/reference.html
5) Map Currency Update Approach <CR_5.2>
Indicate how often you plan on updating the mappings to reflect new CVE versions and describe your approach to keeping reasonably current with CVE versions when mapping them to your repository (recommended):
We display this data on the following website:
http://descriptions.securescout.com/reference.html
CVE mapping is easily accomplished by searching through a browser, there is no need for SQL data mining.
6) Map Currency Update Time <CR_5.3>
Describe how and where you explain to your customers the timeframe they should expect an update of your capability's mappings to reflect a newly released CVE version (recommended):
We publish a weekly update to the software which includes CVE references for all new and past vulnerabilities. These updates come with release notes weekly.
7) CVE and Compatibility Documentation<CR_4.1>
Provide a copy, or directions to its location, of where your documentation describes CVE and CVE compatibility for your customers (required):
This is provided in the product in the form of CVE references in the generated remediation reports, user manual, testcase descriptions, database and website:
http://www.netvigilance.com
8) Documentation of Finding Elements Using CVE Names <CR_4.2>
Provide a copy, or directions to its location, of where your documentation describes the specific details of how your customers can use CVE names to find the individual security elements within your capability's repository (required):
1. Expand CVE branch in the policy tree to find test case to CVE cross- references.
2. The list of Test cases by CAN / CVE reference are listed
The list of our by Test Case ID, CVE Link, Test Case Name is referenced at: http://descriptions.securescout.com/reference.html
(See question #5 above)
9) Documentation of Finding CVE Names Using Elements <CR_4.3>
Provide a copy, or directions to its location, of where your documentation describes the process a user would follow to find the CVE names associated with individual security elements within your capability's repository (required):
The customer can expand CVE branch in the policy tree to find test case to CVE cross-references. The user manual describes this in detail.
(See question #8 above)
The list of our by Test Case ID, CVE Link, Test Case Name is referenced at: http://descriptions.securescout.com/reference.html
(See question #5 above)
10) Documentation Indexing of CVE-Related Material <CR_4.4>
If your documentation includes an index, provide a copy of the items and resources that you have listed under "CVE" in your index. Alternately, provide directions to where these "CVE" items are posted on your web site (recommended):
This index is available online at the following url:
http://descriptions.securescout.com/reference.html(See question #5 above)
11) Candidates Versus Entries Indication <CR_6.1>
If CVE candidates are supported or used, explain how you indicate that candidates are not accepted CVE entries (required):
We do support CVE candidates. We reference all CVE numbers, including the CVE / CAN indicators. We direct the user to the CVE website for all CVE entries and candidates referenced in our products.
12) Candidates Versus Entries Explanation <CR_6.2>
If CVE candidates are supported or used, explain where and how the difference between candidates and entries is explained to your customers (recommended):
We do support CVE candidates. We reference all CVE numbers, candidates are differentiated by CVE / CAN designators. We direct the user to the CVE website for all CVE entries and candidates referenced in our products.
(See question #11 above)
13) Candidate to Entry Promotion <CR_6.3>
If CVE candidates are supported or used, explain your policy for changing candidates into entries within your capability and describe where and how this is communicated to your customers (recommended):
We automatically update our database on a weekly basis, by referencing the CVE website and changing any candidate entries to CVE entries. These updates come with release notes weekly, published in weekly newsletter.
14) Candidate and Entry Search Support <CR_6.4>
If CVE candidates are supported or used, explain where and how a customer can find the explanation of your search function's ability to look for candidates and entries by using just the YYYY-NNNN portion of the CVE names (recommended):
Users can search our testcase references on our website at the following url: http://descriptions.securescout.com/reference.html
There is a search function included in the software that will allow users to search for specific test cases based on CVE number.
(See question #5 above)
15) Search Support for Promoted Candidates <CR_6.5>
If CVE candidates are supported or used, explain where and how a customer can find the explanation of your search function's support for retrieving the CVE entry for a candidate that is no longer a candidate (recommended):
Online help user manual, tool help function.
16) Candidate Mapping Currency Indication <CR_6.6>
If CVE candidates are supported or used, explain where and how you tell your users how up-to-date your candidate information is (recommended):
We automatically update our database on a weekly basis, by referencing the CVE website and changing any candidate entries to CVE entries. These updates come with release notes weekly. Customers are informed by automatic new test case alerts in the software, weekly update release notes, weekly newsletter.
Type-Specific Capability Questions
Service Questions
23) Service Coverage Determination Using CVE Names <CR_A.3.1>
Give detailed examples and explanations of the different ways that a user can use CVE names to find out which security elements are tested or detected by the service (i.e. by asking, by providing a list, by examining a coverage map, or by some other mechanism) (required):
1. Launch SecureScout
2. Expand 'By CVE Code'(See question #8 above)
3. CVE/CAN references are listed and available for search.
(See question #8 above)
The list of our by Test Case ID, CVE Link, Test Case Name is referenced at: http://descriptions.securescout.com/reference.html
(See question #5 above)
24) Finding CVE Names in Service Reports Using Elements <CR_A.3.2>
Give detailed examples and explanations of how, for reports that identify individual security elements, the user can determine the associated CVE names for the individual security elements in the report (required):
(See question #8 above)
25) Service's Product Utilization Details <CR_A.3.4>
Please provide the name and version number of any product that the service allows users to have direct access to if that product identifies security elements (recommended):
netVigilance SecureScout SP v. 1.9.137.131
26) Finding Online Capability Tasks Using CVE Names <CR_A.4.1>
Give detailed examples and explanations of how a "find" or "search" function is available to the user to locate tasks in the online capability by looking for their associated CVE name or through an online mapping that links each element of the capability with its associated CVE name(s) (required):
The customer can expand CVE branch in the policy tree to find test case to CVE cross-references. The user manual describes this in detail. The list of our by Test Case ID, CVE Link, Test Case Name is referenced at:
http://descriptions.securescout.com/reference.html(See question #5 above)
29) Finding CVE Names Using Online Capability Elements <CR_A.4.2>
Give detailed examples and explanations of how, for reports that identify individual security elements, the online capability allows the user to determine the associated CVE names for the individual security elements in the report (required):
(See question #8 above)
31) Electronic Document Format Info <CR_B.3.1>
Provide details about the different electronic document formats that you provide and describe how they can be searched for specific CVE-related text (required):
We support html, pdf and text formats. These can be searched with the search capabilities within a web browser, word processor, document viewer, unix utilities.
32) Electronic Document Listing of CVE Names <CR_B.3.2>
If one of the capability's standard electronic documents only lists security elements by their short names or titles provide example documents that demonstrate how the associated CVE names are listed for each individual security element (required):
CVE names are listed individually and included as references in our database from vulnerability short names. CVE names can be cross referenced by searching the CVE list or by searching the vulnerability descriptions.
33) Electronic Document Element to CVE Name Mapping <CR_B.3.3>
Provide example documents that demonstrate the mapping from the capability's individual elements to the respective CVE name(s) (recommended):
The customer can expand CVE branch in the policy tree to find test case to CVE cross-references. The user manual describes this in detail.
The list of our by Test Case ID, CVE Link, Test Case Name is referenced at: http://descriptions.securescout.com/reference.html
(See question #5 above)
34) Finding Elements Using CVE Names Through the GUI <CR_B.4.1>
Give detailed examples and explanations of how the GUI provides a "find" or "search" function for the user to identify your capability's elements by looking for their associated CVE name(s) (required):
3. Launch SecureScout
4. Expand 'By CVE Code'(See question #8 above)
5. CVE/CAN references are listed and available for search.
(See question #8 above)
35) GUI Element to CVE Name Mapping <CR_B.4.2>
Briefly describe how the associated CVE names are listed for the individual security elements or discuss how the user can use the mapping between CVE entries and the capability's elements, also describe the format of the mapping (required):
All reports include a Description of the vulnerability, severity of risk, remediation steps, links for the patch and links to the CVE website.
36) GUI Export Electronic Document Format Info <CR_B.4.3>
Provide details about the different electronic document formats that you provide for exporting or accessing CVE-related data and describe how they can be searched for specific CVE-related text (recommended):
All reports can be exported as html, pdf, text. The report are all contained within an open SQL database. All of these formats can be searched for CVE references with their own search methods.
37) Statement of Compatibility <CR_2.7>
Have an authorized individual sign and date the following Compatibility Statement (required):
"As an authorized representative of my organization I agree that we will abide by all of the mandatory CVE Compatibility Requirements as well as all of the additional mandatory CVE Compatibility Requirements that are appropriate for our specific type of capability."
Name: Jesper Jurcenoks
Title: CEO
38) Statement of Accuracy <CR_3.4>
Have an authorized individual sign and date the following accuracy Statement (recommended):
"As an authorized representative of my organization and to the best of my knowledge, there are no errors in the mapping between our capability's Repository and the CVE entries our capability identifies."
Name: Jesper Jurcenoks
Title: CEO
39) Statement on False-Positives and False-Negatives <CR_A.2.8 and/or CR_A.3.5>
FOR TOOLS ONLY - Have an authorized individual sign and date the following statement about your tools efficiency in identification of security elements (required):
"As an authorized representative of my organization and to the best of my knowledge, normally when our capability reports a specific security element, it is generally correct and normally when an event occurs that is related to a specific security element our capability generally reports it."
Name: Jesper Jurcenoks
Title: CEO