SCAP

Updated Jan 30, 2024 ·

Overview

Security Content Automation Protocol (SCAP) is a collection of open standards developed by the National Institute of Standards and Technology (NIST) to automate vulnerability management, measurement, and policy compliance evaluation.

Supported Languages

Three main languages used inside a SCAP:

• Open Vulnerability and Assessment Language (OVAL)

  • Vulnerability Reporting Format
  • XML schema for reporting vulnerabilities and configuration issues.
  • Describe system information, machine state, and the reporting method.
  • Allows for consistent and interoperable way of collecting information.

• Extensible Configuration Checklist Description Format (XCCDF)

  • Security Automation Data
  • XML schema for developing and auditing best practice configuration rules.
  • Describes security configuration guidelines and automated test procedures.
  • Before XCCDF, a long document containing step-by-step guide is used.
  • With XCCDF, we can use automated scanning tools to check the systems.

• Asset Reporting Format (ARF)

  • XML schema for expressing informattion about assets and relationships.
  • Standardized format for reporting asset identification and metadata.
  • Vendor and technology neutral, suited for different reporting applications.

Enumeration Methods

There are also different methods of enumerating assets.

Common Configuration Enumeration (CCE)

Common Configuration Enumeration (CCE) is part of the SCAP ecosystem and complements CPE, CVE, and related standards. It provides a standardized identifier for system security configuration settings.

• Security Checklists.
• Guidelines and best practices for secure system configuration.
• Unique identifiers for different configuration system issues.

Example: A CCE ID like CCE-12345-6 could represent “Ensure the Windows firewall is enabled for all profiles.”

Common Platform Enumeration (CPE)

Common Platform Enumeration (CPE) is a standardized naming scheme for IT systems, software, and hardware. It uniquely identifies platforms, operating systems, and applications. It is written in machine-readable format, with prefix:

cpe:/ 

Standard format:

cpe:/<part>:<vendor>:<product>:<version>:<update>:<edition>:<language>

Example:

cpe:/a:microsoft:internet_explorer:11.0

Common Vulnerabilities and Exposures (CVE)

Common Vulnerabilities and Exposures (CVE) is a list of records of security flaws or vulnerability definitions. Each CVE has the following format:

CVE-YYYY-NNNN         ## YYYY is year, NNNN is unique number.

CVSS

CVSS, or Common Vulnerability Scoring System, provides a standardized method for rating vulnerabilities to help organizations prioritize their responses and allocate resources effectively.

• Scores are based on metrics evaluating exploitability and impact.
• Metrics include base, temporal, and environmental scores.
• Higher scores means more severe vulnerabilities.

Qualitative severity ratings:

• Low
• Medium
• High
• Critical

CVSS Ratings:

CVSS Score Range	Severity Rating
0.0 - 3.9	Low
4.0 - 6.9	Medium
7.0 - 8.9	High
9.0 - 10.0	Critical

Benchmarks

A benchmark is a set of security configuration rules for some specific set or products to provide a detailed checklist that can be used to secure systems to a specific baseline.

• Usually expressed in the XCCDF.
• Examples are benchmark from Red Hat and CIS.