|
|
Name of Your Organization:
Archer Technologies
Web Site:
www.archer-tech.com
Compatible Capability:
Archer Threat Management
Capability home page:
http://www.archer-tech.com/solutions/threat_management/index.html
1) Product Accessibility <CR_2.4>
Provide a short description of how and where your capability is made available to your customers and the public (required):
The Archer Threat Management solution provides a centralized repository of threat data, clear reporting of activities related to threat remediation, and a consistent and repeatable threat management process. Archer's Threat Management is pre-integrated with security intelligence feeds from VeriSign® iDefense®, Symantec™ DeepSight and Cisco® Security IntelliShield Alert Manager Service.
The Archer Threat Management solution provides a field called CVE that displays the CVE ID [CVE-2007-6422] or CAN-ID [CAN-2000-0256], as provided by the vendors listed above. Customers can access this information through the Archer Threat Management solution
4) Map Currency Indication <CR_5.1>
Describe how and where your capability indicates the most recent CVE version used to create or update its mappings (required):
CVE references are mapped to the vulnerability that they represent, by the threat feed vendors listed in Item 1, and presented through the CVE(s) field within the vulnerability application of the Archer's Threat Management solution. Users who wish to view a vulnerability mapped to a CVE ID [CVE-2007-6422] can perform a search using Archer's keyword, navigation menu and advanced search functionalities.
Refer to Item 31, for an overview of how to perform a search, view the full vulnerability elements and access CVE related information.
5) Map Currency Update Approach <CR_5.2>
Indicate how often you plan on updating the mappings to reflect new CVE versions and describe your approach to keeping reasonably current with CVE versions when mapping them to your repository (recommended):
CVE references are mapped to the vulnerability that they represent, by the threat feed vendors listed in Item 1, and presented through the CVE(s) field within the vulnerability application of the Archer's Threat Management solution. Users who wish to view a vulnerability mapped to a CVE ID [CVE-2007-6422] can perform a search using Archer's keyword, navigation menu and advanced search functionalities.
Refer to Item 31, for an overview of how to perform a search, view the full vulnerability elements and access CVE related information.
6) Map Currency Update Time <CR_5.3>
Describe how and where you explain to your customers the timeframe they should expect an update of your capability's mappings to reflect a newly released CVE version (recommended):
CVE references are mapped to the vulnerability that they represent, by the Threat Feed vendor, and presented through the CVE(s) field within the Archer's Threat Management solution. Users who wish to view a vulnerability mapped to a CVE ID [CVE-2007-6422] can perform a search using Archer's keyword, navigation menu and advanced search functionalities.
Refer to Item 31, for an overview of how to perform a search, view the full vulnerability elements and access CVE related information.
7) CVE and Compatibility Documentation<CR_4.1>
Provide a copy, or directions to its location, of where your documentation describes CVE and CVE compatibility for your customers (required):
Archer Technologies Threat Management solutions description of the Common Vulnerability Exposures (CVE) and our compatibility is currently listed in our on-line help files under the Threat Management solution definitions.
Common Vulnerabilities and Exposures (CVE)
The Common Vulnerabilities and Exposures (CVE) identifier uniquely names the vulnerability and includes a list of vulnerabilities and exposures, providing organizations with common names for publicly known problems.
CVE is a formal initiative whose goal is to standardize the names for all publicly known vulnerabilities and security exposures. CVE is run by an editorial board and chaired by a representative of the MITRE Corporation, a not-for-profit organization. Mitre CVE is funded by the U.S. Department of Homeland Security.
The CVE identifier makes it easy for organizations to share data across separate vulnerability databases and security tools. Knowing the vulnerability's CVE identifier lets you quickly and accurately access information about the vulnerability across multiple information sources that are CVE-compatible. For example, if you use an Intrusion Detection System and it generates an alert that has a referenced CVE number, you can search Archer's Threat Management database by the CVE ID to quickly identify the name of the vulnerability that the attack is trying to exploit.
Using Archer's Advanced Search feature, you can obtain a list of all vulnerabilities that are based on CVE reference. Users can then view each vulnerability to understand their details, such as description, severity, affected technologies, vendor fix and much more.
For additional information about Mitre CVE, visit https://cve.mitre.org/.
8) Documentation of Finding Elements Using CVE Names <CR_4.2>
Provide a copy, or directions to its location, of where your documentation describes the specific details of how your customers can use CVE names to find the individual security elements within your capability's repository (required):
Refer to Item 7
9) Documentation of Finding CVE Names Using Elements <CR_4.3>
Provide a copy, or directions to its location, of where your documentation describes the process a user would follow to find the CVE names associated with individual security elements within your capability's repository (required):
Refer to Item 7
10) Documentation Indexing of CVE-Related Material <CR_4.4>
If your documentation includes an index, provide a copy of the items and resources that you have listed under "CVE" in your index. Alternately, provide directions to where these "CVE" items are posted on your web site (recommended):
Type-Specific Capability Questions
11) Finding Tasks Using CVE Names <CR_A.2.1>
Give detailed examples and explanations of how a user can locate tasks in the tool by looking for their associated CVE name (required):
By using the different search functionalities (keyword, advanced search or navigation menu, users can access technical details for vulnerabilities. If there are numerous elements that support the vulnerability, they are all listed within the technical details.
Refer to Item 31, for an overview of how to perform a search, view the full vulnerability elements and access tasks with related CVE related information.
12) Finding CVE Names Using Elements in Reports <CR_A.2.2>
Give detailed examples and explanations of how, for reports that identify individual security elements, the tool allows the user to determine the associated CVE names for the individual security elements in the report (required):
By using the different search functionalities (keyword, advanced search or navigation menu, users can access technical details for vulnerabilities. If there are numerous elements that support the vulnerability, they are all listed within the technical details.
Refer to Item 31, for an overview of how to perform a search, view the full vulnerability elements and access tasks with related CVE related information.
13) Getting a List of CVE Names Associated with Tasks <CR_A.2.4>
Give detailed examples and explanations of how a user can obtain a listing of all of the CVE names that are associated with the tool's tasks (recommended):
The Archer's Threat Management solution can provide users with different ways for obtaining a list of all of the CVE's associated with a task. For example, through the cross-reference to the Archer Asset Management solution, users can access a vulnerability task-list that need to be addressed. This tasks list provides the names of the Vulnerabilities and the CVE ID as shown below.
In addition to the example above, users can also enable the task management functionality to track tasks associated with specific vulnerabilities by the CVE ID.
Refer to Item 31, for an overview of how to perform a search, view the full vulnerability elements and access tasks with related CVE related information.
14) Selecting Tasks with a List of CVE Names <CR_A.2.5>
Describe the steps and format that a user would use to select a set of tasks by providing a file with a list of CVE names (recommended):
Refer to Item 31, for an overview of how to perform a search, view the full vulnerability elements and access tasks with related CVE related information.
15) Selecting Tasks Using Individual CVE Names <CR_A.2.6>
Describe the steps that a user would follow to browse, select, and deselect a set of tasks for the tool by using individual CVE names (recommended):
Refer to Item 31, for an overview of how to perform a search, view the full vulnerability elements and access tasks with related CVE related information.
16) Non-Support Notification for a Requested CVE Name <CR_A.2.7>
Provide a description of how the tool notifies the user that task associated to a selected CVE name cannot be performed (recommended):
The Archer Threat Management solution allows users to create notifications templates that can be used to send notifications to a group of users, when the status of a task has changed. In the case that there is a task associated to a selected CVE name that cannot be performed this can be noted as a status/value in the Archer solution, and can be configured to generate alerts based on the value selected.
You can configure this notification template to provide the specific information that you would like to communicate.
17) Service Coverage Determination Using CVE Names <CR_A.3.1>
Give detailed examples and explanations of the different ways that a user can use CVE names to find out which security elements are tested or detected by the service (i.e. by asking, by providing a list, by examining a coverage map, or by some other mechanism) (required):
A good example of how a Archer users can use the CVE is if you use a Vulnerability Scanner to detect network vulnerabilities. Typically scanners provide summarized information about the vulnerability. If you import the vulnerability scan results into the Archer SmartSuite Framework, we can then map your vulnerability scan results against Archer's Threat Management database using the industry standard common vulnerability exposure ID (CVE). This map allows you to extend the vulnerability information provided by the vulnerability scanner with additional vulnerability information and details provided by leading threat alert providers.
18) Finding CVE Names in Service Reports Using Elements <CR_A.3.2>
Give detailed examples and explanations of how, for reports that identify individual security elements, the user can determine the associated CVE names for the individual security elements in the report (required):
Refer to Item 31, for an overview of how to perform a search, view the full vulnerability elements and access CVE related information.
20) Finding Online Capability Tasks Using CVE Names <CR_A.4.1>
Give detailed examples and explanations of how a "find" or "search" function is available to the user to locate tasks in the online capability by looking for their associated CVE name or through an online mapping that links each element of the capability with its associated CVE name(s) (required):
Refer to Item 31, for an overview of how to perform a search, view the full vulnerability elements and access CVE related information.
25) Finding Elements Using CVE Names <CR_A.5.1>
Give detailed examples and explanations of how a user can associate elements in the capability by looking for their associated CVE name (required):
Refer to Item 31, for an overview of how to perform a search, view the full vulnerability elements and access CVE related information.
26) Finding CVE Names Using Elements in Reports <CR_A.5.2>
Give detailed examples and explanations of how, for reports that identify individual security elements, the capability allows the user to determine the associated CVE names for the individual security elements in the report (required):
Refer to Item 31, for an overview of how to perform a search, view the full vulnerability elements and access CVE related information.
27) Getting a List of CVE Names Associated with Tasks <CR_A.5.4>
Give detailed examples and explanations of how a user can obtain a listing of all of the CVE names that are associated with the capability's tasks (recommended):
Refer to Item 13
28) Selecting Tasks with a List of CVE Names <CR_A.5.5>
Describe the steps and format that a user would use to select a set of tasks by providing a file with a list of CVE names (recommended):
Refer to Item 13
29) Selecting Tasks Using Individual CVE Names <CR_A.5.6>
Describe the steps that a user would follow to browse, select, and deselect a set of tasks for the capability by using individual CVE names (recommended):
Refer to Item 13
30) Electronic Document Format Info <CR_B.3.1>
Provide details about the different electronic document formats that you provide and describe how they can be searched for specific CVE-related text (required):
The Archer Threat Management solution is a web-enabled application that can be accessed by users through their web-browser. Using a web-browser, users can view the CVE mapped vulnerabilities in HTML.
Using Archer's keyword, navigation menu and advanced search functionalities, users can perform filter searches to view vulnerabilities by CVE ID, Technology, Risk, CVSS, etc.
Refer to Item 31, for an overview of how to perform a search, view the full vulnerability elements and access CVE related information.
31) Electronic Document Listing of CVE Names <CR_B.3.2>
If one of the capability's standard electronic documents only lists security elements by their short names or titles provide example documents that demonstrate how the associated CVE names are listed for each individual security element (required):
The Archer Threat Management solution is a web-enabled application that can be accessed by users through their web-browser. Using a web-browser, users can view the CVE mapped vulnerabilities in HTML. Using Archer's keyword, navigation menu and advanced search functionalities, users can perform filter searches to view vulnerabilities by CVE ID [CVE-2007-6422] Technology, Risk, CVSS, etc.
For example, users can use the keyword search to search for a specific CVE ID [CVE-2007-6422] as shown below.
- Enter the CVE ID
- Select the Threat Management solution from the drop-down
- Click on the Search (Magnifying Glass icon).
Once the user clicks on the search button, then the results will be generated and CVE will be highlighted.
Clicking into the Vulnerability name displays users with the full vulnerability details.
The other way to perform searches can be by using the Navigation Menu. Once the user clicks on display all, the system will generate a report that displays all vulnerabilities within the database. As a user you can control what fields and the order of how they are displayed as shown below:
Once you view the report, you can click the Vulnerability name displays users with the full vulnerability details.
The third option is by using Archer Advanced Search functionality. Through this functionality users can use additional parameters to perform a query such as:
- Use operators such as AND, OR, and AND NOT to refine your search.
- Place quotation marks around multiple keywords to perform an exact phrase match. (Example: "John Smith")
- Add an asterisk at the end of your keyword to match words with a like beginning. (Example: Smith* returns Smith, Smiths)
- Add a question mark as a wildcard for a single character. (Example: Smit? returns Smith, Smitz)
In addition, users can select the fields that they would like to report on, define the applicable filters (i.e. Severity = Extreme, High, Medium, Low, Minimal) and define the display options as shown below.
Once the user defines the search parameters [CVE-2007-6420 OR CVE-2007-6422] and clicks on the Search button, a new report will be generated for the specific information that they requested.
32) Electronic Document Element to CVE Name Mapping <CR_B.3.3>
Provide example documents that demonstrate the mapping from the capability's individual elements to the respective CVE name(s) (recommended):
CVE references are mapped to the vulnerability that they represent, by the Threat Feed vendor, and presented through the CVE(s) field within the Archer's Threat Management solution.
Example of XML data provided by vendor
Once the data elements are provided by the provided, Archer would then import them into specific fields within the Threat Management solution.
Users who wish to view a vulnerability mapped to a CVE ID can perform a search using Archer's keyword, navigation menu and advanced search functionalities. Refer to Item 31, for an overview of how to perform a search, view the full vulnerability elements and access CVE related information.
33) Finding Elements Using CVE Names Through the GUI <CR_B.4.1>
Give detailed examples and explanations of how the GUI provides a "find" or "search" function for the user to identify your capability's elements by looking for their associated CVE name(s) (required):
The Archer Threat Management solution is a web-enabled application that can be accessed by users through their web-browser. Using a web-browser, users can view the CVE mapped vulnerabilities in HTML.
Using Archer's keyword, navigation menu and advanced search functionalities, users can perform filter searches to view vulnerabilities by CVE ID [CVE-2007-6422] Technology, Risk, CVSS, etc.
Refer to Item 31, for an overview of how to perform a search, view the full vulnerability elements and access CVE related information.
34) GUI Element to CVE Name Mapping <CR_B.4.2>
Briefly describe how the associated CVE names are listed for the individual security elements or discuss how the user can use the mapping between CVE entries and the capability's elements, also describe the format of the mapping (required):
CVE references are mapped to the vulnerability that they represent, by the Threat Feed vendor, and presented through the CVE(s) field within the Archer's Threat Management solution. Users who wish to view a vulnerability mapped to a CVE ID can perform a search using Archer's keyword, navigation menu and advanced search functionalities.
Refer to Item 31, for an overview of how to perform a search, view the full vulnerability elements and access CVE related information.
35) GUI Export Electronic Document Format Info <CR_B.4.3>
The Archer Threat Management solution is a web-enabled application that can be accessed by users through their web-browser. Using a web-browser, users can view the CVE mapped vulnerabilities in HTML. In addition, the Threat Management solution allows customers to export the CVE mapped vulnerabilities as Word, PDF, Microsoft Excel, CVS, HTML or XML files as shown below.
In addition, users have the ability to click the Email icon on the top right hand side of the page and send the record to another person.
Once the user clicks on the Email icon, a new message will be created and provide a hyperlink to the record.
36) Statement of Compatibility <CR_2.7>
Have an authorized individual sign and date the following Compatibility Statement (required):
"As an authorized representative of my organization I agree that we will abide by all of the mandatory CVE Compatibility Requirements as well as all of the additional mandatory CVE Compatibility Requirements that are appropriate for our specific type of capability."
Name: Eric Herrera
Title: Archer Technologies, Senior Product Manager
37) Statement of Accuracy <CR_3.4>
Have an authorized individual sign and date the following accuracy Statement (recommended):
"As an authorized representative of my organization and to the best of my knowledge, there are no errors in the mapping between our capability's Repository and the CVE entries our capability identifies."
Name: Eric Herrera
Title: Archer Technologies, Senior Product Manager
38) Statement on False-Positives and False-Negatives <CR_A.2.8 and/or CR_A.3.5>
FOR TOOLS ONLY - Have an authorized individual sign and date the following statement about your tools efficiency in identification of security elements (required):
"As an authorized representative of my organization and to the best of my knowledge, normally when our capability reports a specific security element, it is generally correct and normally when an event occurs that is related to a specific security element our capability generally reports it."
Name: Eric Herrera
Title: Archer Technologies, Senior Product Manager