CCS adopts the Security Content Automation Protocol (SCAP) suite of specifications, which is a validation program defined by National Institute of Standards and Technology (NIST). The SCAP standards are used to enable automated vulnerability management, measurement, and policy compliance evaluation of the enterprise organization.
SCAP is established by NIST to standardize the format and nomenclature by which security software products communicate software flaws and security configuration information. Adoption of SCAP facilitates an organization's automation of security monitoring, vulnerability management, and security policy compliance evaluation and reporting.
For more details on SCAP, refer to http://scap.nist.gov/
CCS supports implementation of SCAP 1.2, SCAP 1.1, and SCAP 1.0 specification.
The SCAP 1.2 specification comprises the following component specifications:
Extensible Configuration Checklist Description Format (XCCDF) 1.2
Open Vulnerability and Assessment Language (OVAL®) 5.10.1
Common Configuration Enumeration (CCE™) 5
Common Platform Enumeration (CPE™) 2.3
Common Vulnerabilities and Exposures (CVE®)
Common Vulnerability Scoring System (CVSS) 2.0
Asset Identification 1.1
Asset Reporting Format (ARF) 1.1
Note: |
SCAP version 1.2 supersedes SCAP version 1.0 and SCAP version 1.1. |
The SCAP 1.0 specification comprises the following six component specifications:
Extensible Configuration Checklist Description Format (XCCDF) v1.1.4
Open Vulnerability and Assessment Language (OVAL) v5.3
Common Platform Enumeration (CPE) v2.2
Common Configuration Enumeration (CCE) v5
Common Vulnerabilities and Exposures (CVE)
Common Vulnerability Scoring System (CVSS) v2
CCS facilitates import of valid SCAP 1.2, SCAP 1.1, and SCAP 1.0 content including the content published officially by NIST, from the following location:
http://web.nvd.nist.gov/view/ncp/repository.
The SCAP content that is imported in CCS cannot be edited. The in-built functionalities of CCS are leveraged to execute the SCAP evaluation job that collects data from assets and evaluates them against the SCAP content. The CCS Manager that is configured as a Windows data collector performs the task of data collection and evaluation of SCAP content.
To know more about CCS Manager Collector, refer to About the CCS Manager Collector topic in the CCS SymHelp.
The SCAP evaluation results can be viewed in the Evaluation Results Viewer or the report generation feature of CCS can be used to generate the Asset Details report. The evaluated data is also rendered on CCS Dashboards such as, Compliance Administration - SCAP profile benchmark.
See About SCAP content
See Viewing the imported SCAP benchmarks in CCS
See Evaluating assets against the SCAP benchmarks
See Exporting the evaluation results for SCAP content and OVAL definitions
See Generating reports of the SCAP evaluated results
See Accessing dashboards of SCAP benchmarks
Thanks for your feedback. Let us know if you have additional comments below. (requires login)