Subject: Re: [sacm] [OVAL-DEVELOPER-LIST] Access Vulnerability Database with Java

From: "Waltermire, David A." <[email-masked]>
Date: Wed, 2 May 2012 17:34:15 -0400

With some of the current email discussion, I'd like to provide a brief update on some projects my team has been working on in this area.  We are currently working on the following activities:

1)      Prototyping a federated, generalized XML-based content repository approach.  The current effort is using a metamodel to describe the key objects (called "entities") in an XML model and the content references (called "relationships") that exist within an XML document.  We have developed a shredder that reads in an XML instance, breaking down the entities and relationships.  It then persists the XML chunks in an XML database and the entity and relationship information in a non-relational RDF database.  We can also request the content back out of the datastore and reconstitute it.  The approach we are using does not perturb the underlying XML infoset, so signatures can be verified for content retrieved out of the repository.

We are currently working on web service (SOAP and REST) interfaces and a generalized query language.  Our current development phase will end in the next couple months.  We hope to have a downloadable demo available before Security Automation Developer Days in early July that will support requesting an SCAP datastream or a collection of OVAL/OCIL definitions (and related components) by identifier and version.

We are avoiding the registration problem by extracting a DNS name out of the content identifier.

For example the content referenced by:

oval:org.mitre.oval:def:1

Can be retrieved by the content server "oval.mitre.org".

The plan is to use this to lookup a DNS SRV record (RFC 2782<http://www.ietf.org/rfc/rfc2782.txt>) to locate the repository that is responsible for the content identified.  This can be used to dynamically retrieve the referenced content.  We are just starting to work out an XML format for repository-to-repository information exchange to enable this communication.

At this point our current repository code is not far from replacing the data backend that is used for the OVAL repository.  The cool thing about the overall approach is that no OVAL specific code is necessary.  We have created XML-based shredding rules for SCAP datastream, OVAL 5.10.1 and XCCDF 1.2 formats.  It is fairly trivial to create new shredding rules for additional models.

You can review the code at:

http://code.google.com/p/security-automation-content-repository/

Most of our work is being done in the SVN branch:

http://security-automation-content-repository.googlecode.com/svn/branches/new-shredder

The documentation is very sparse and the code needs some cleanup.  We plan to work on this in the near future.  Our long-term goal is to provide a freely available, production capable content repository server that can participate in a federated network of content servers.

2)      We have also been working on a content repository specification.  The goal for this document is to describe the overall federation approach and to detail the data exchange models, interfaces and transports needed to support interoperability.  I plan to have a draft of this specification ready in September.  I would be happy to submit this as an individual submission to the IETF when it is more complete.

My hope is that this work will address many of the communities challenges in this area.  I'd appreciate any thoughts or feedback on this overall approach.  Please let me know if you have any questions.  I have also requested a session at the Security Automation Developer Days hosted by MITRE in early July to review and discuss this work in greater detail.

Sincerely,
Dave Waltermire

From: Kent Landfield [mailto:[email-masked]]
Sent: Saturday, April 28, 2012 6:17 PM
To: [email-masked]
Subject: Re: [OVAL-DEVELOPER-LIST] Access Vulnerability Database with Java

;-)

As was properly pointed out to me ...there was a typo in my message...

"This is one of the topics I would like to see developed on the SCAM list."

Should have been...

This is one of the topics I would like to see developed on the SACM list.

;-)

Kent Landfield
Director Content Strategy, Architecture and Standards

McAfee | An Intel Company
5000 Headquarters Dr.
Plano, Texas 75024

Direct: +1.972.963.7096
Mobile: +1.817.637.8026
Web: www.mcafee.com<http://www.mcafee.com/>

From: <Landfield>, Kent Landfield <[email-masked]<mailto:[email-masked]>>
Reply-To: "OVAL Developer List (Closed Public Discussion)" <[email-masked]<mailto:[email-masked]>>
To: "[email-masked]<mailto:[email-masked]>" <[email-masked]<mailto:[email-masked]>>
Subject: Re: [OVAL-DEVELOPER-LIST] Access Vulnerability Database with Java

This has been discussed at the last two ITSAC conference and the Winter Developer Days last year.  Discussions have been had around the needs on the SACM list as well.   This is an effort to get a standard means for distributing SCAP related content within an organization and as a potentially federated means of managing content developed by guidance authors such as CIS, NIST, other government entities and industry verticals.

Couple links to past presentations.

http://www.google.com/url?sa=t&rct=j&q=&esrc=s&source=web&cd=2&ved=0CDAQFjAB&url=http%3A%2F%2Fscap.nist.gov%2Fevents%2F2011%2Fsaddsp%2Fpresentations%2FKent_Landfield-Automation_Content_Repositories.pdf&ei=nlOcT-P7L8aWiAKGo6GTAQ&usg=AFQjCNHvTNEztVQmZhkisLkdcB58EpS8Sw&sig2=HY5JjENzc4wMe2tVc4inAA

http://scap.nist.gov/events/2011/saddsp/presentations/Security_Automation_Content_Repository_Demo.pdf

http://scap.nist.gov/events/2011/itsac/presentations/day3/Landfield,%20Chernin,%20Basavanna%20-%20Content%20Repositories.pdf

There was also a presentation that Adam Montville prepared for the IETF SACM Side meeting. They are available in the zip file of the presentations located in http://www.ietf.org/mail-archive/web/sacm/current/msg00178.html

This is one of the topics I would like to see developed on the SCAM list.

Kent Landfield
Director Content Strategy, Architecture and Standards

McAfee | An Intel Company
5000 Headquarters Dr.
Plano, Texas 75024

Direct: +1.972.963.7096
Mobile: +1.817.637.8026
Web: www.mcafee.com<http://www.mcafee.com/>

From: David Solin <[email-masked]<mailto:[email-masked]>>
Reply-To: "OVAL Developer List (Closed Public Discussion)" <[email-masked]<mailto:[email-masked]>>
To: "[email-masked]<mailto:[email-masked]>" <[email-masked]<mailto:[email-masked]>>
Subject: Re: [OVAL-DEVELOPER-LIST] Access Vulnerability Database with Java

We'd certainly be interested in implementing any such standard.  Can you point me to who's actively discussing it?  Does MITRE intend to support any standard approaches to repository access?

Regards,
--David

On 4/28/2012 6:56 AM, Luis Nunez wrote:
You know there is talk of producing a standard spec (sacm) to do something like this.  I know we are busy but something to think about.

It would be cool to joval be able to directly query and pull down content directly from SecPod and other repositories in a common way.

-ln

On Apr 27, 2012, at 5:39 PM, David Solin wrote:

jOVAL provides a ready-to-use JAXB data model for the OVAL language, various utility classes, and of course, an evaluation engine and scan plug-ins.  It does not, however, implement access to any on-line repositories.

Feel free to contact me directly if you have any questions.

Regards,
--David Solin
--

jOVAL.org<http://jOVAL.org>: OVAL implemented in Java.
Scan any machine from any machine. For free!
Learn More<http://www.joval.org/> | Features<http://www.joval.org/features/> | Download<http://www.joval.org/download/>

On 4/27/2012 8:48 AM, vulists wrote:

Hi There,

I'm looking for a way to access a Vulnerability Database with Java.

At the moment I'm not 100% sure if its gonna be OpenVAS or something

else, like e.g. OVAL.

I wanted to ask, if somebody knows some ready-to-use Java API to access

"one of those" Vulnerability Databases.

If thats not the case, does it mean I have to implement my own XML

Parser to get the vulnerability data into my database?

What about standard formats?

Thanks and kind regards

To unsubscribe, send an email message to [email-masked]<mailto:[email-masked]> with

SIGNOFF OVAL-DEVELOPER-LIST

in the BODY of the message.  If you have difficulties, write to [email-masked]<mailto:[email-masked]>.

To unsubscribe, send an email message to [email-masked]<mailto:[email-masked]> with SIGNOFF OVAL-DEVELOPER-LIST in the BODY of the message. If you have difficulties, write to [email-masked]<mailto:[email-masked]>.

To unsubscribe, send an email message to [email-masked]<mailto:[email-masked]> with SIGNOFF OVAL-DEVELOPER-LIST in the BODY of the message. If you have difficulties, write to [email-masked]<mailto:[email-masked]>.

--

jOVAL.org: OVAL implemented in Java.
Scan any machine from any machine. For free!
Learn More<http://www.joval.org> | Features<http://www.joval.org/features/> | Download<http://www.joval.org/download/>
To unsubscribe, send an email message to [email-masked]<mailto:[email-masked]> with SIGNOFF OVAL-DEVELOPER-LIST in the BODY of the message. If you have difficulties, write to [email-masked]<mailto:[email-masked]>.
To unsubscribe, send an email message to [email-masked]<mailto:[email-masked]> with SIGNOFF OVAL-DEVELOPER-LIST in the BODY of the message. If you have difficulties, write to [email-masked]<mailto:[email-masked]>.
To unsubscribe, send an email message to [email-masked]<mailto:[email-masked]> with SIGNOFF OVAL-DEVELOPER-LIST in the BODY of the message. If you have difficulties, write to [email-masked]<mailto:[email-masked]>.

---

From: Michael Hammer <[email-masked]>
Date: Wed, 2 May 2012 23:34:20 +0000

David,

Is there any IPR associated with this?

Mike

From: [email-masked] [mailto:[email-masked]] On Behalf Of
Waltermire, David A.
Sent: Wednesday, May 02, 2012 5:34 PM
To: OVAL Developer List (Closed Public Discussion); [email-masked]
Subject: Re: [sacm] [OVAL-DEVELOPER-LIST] Access Vulnerability Database with
Java

With some of the current email discussion, I'd like to provide a brief
update on some projects my team has been working on in this area.  We are
currently working on the following activities:

1)      Prototyping a federated, generalized XML-based content repository
approach.  The current effort is using a metamodel to describe the key
objects (called "entities") in an XML model and the content references
(called "relationships") that exist within an XML document.  We have
developed a shredder that reads in an XML instance, breaking down the
entities and relationships.  It then persists the XML chunks in an XML
database and the entity and relationship information in a non-relational RDF
database.  We can also request the content back out of the datastore and
reconstitute it.  The approach we are using does not perturb the underlying
XML infoset, so signatures can be verified for content retrieved out of the
repository. 

We are currently working on web service (SOAP and REST) interfaces and a
generalized query language.  Our current development phase will end in the
next couple months.  We hope to have a downloadable demo available before
Security Automation Developer Days in early July that will support
requesting an SCAP datastream or a collection of OVAL/OCIL definitions (and
related components) by identifier and version.

We are avoiding the registration problem by extracting a DNS name out of the
content identifier.  

The plan is to use this to lookup a DNS SRV record (RFC 2782
<http://www.ietf.org/rfc/rfc2782.txt> ) to locate the repository that is
responsible for the content identified.  This can be used to dynamically
retrieve the referenced content.  We are just starting to work out an XML
format for repository-to-repository information exchange to enable this
communication.

At this point our current repository code is not far from replacing the data
backend that is used for the OVAL repository.  The cool thing about the
overall approach is that no OVAL specific code is necessary.  We have
created XML-based shredding rules for SCAP datastream, OVAL 5.10.1 and XCCDF
1.2 formats.  It is fairly trivial to create new shredding rules for
additional models.

http://security-automation-content-repository.googlecode.com/svn/branches/ne
w-shredder

The documentation is very sparse and the code needs some cleanup.  We plan
to work on this in the near future.  Our long-term goal is to provide a
freely available, production capable content repository server that can
participate in a federated network of content servers.

2)      We have also been working on a content repository specification.
The goal for this document is to describe the overall federation approach
and to detail the data exchange models, interfaces and transports needed to
support interoperability.  I plan to have a draft of this specification
ready in September.  I would be happy to submit this as an individual
submission to the IETF when it is more complete.

My hope is that this work will address many of the communities challenges in
this area.  I'd appreciate any thoughts or feedback on this overall
approach.  Please let me know if you have any questions.  I have also
requested a session at the Security Automation Developer Days hosted by
MITRE in early July to review and discuss this work in greater detail.

Sincerely,

Dave Waltermire

;-)

As was properly pointed out to me .there was a typo in my message.

Should have been.

;-)

Kent Landfield

Direct: +1.972.963.7096 
Mobile: +1.817.637.8026
Web: www.mcafee.com <http://www.mcafee.com/> 

From: <Landfield>, Kent Landfield <[email-masked]>
Reply-To: "OVAL Developer List (Closed Public Discussion)"
<[email-masked]>
To: "[email-masked]"
<[email-masked]>
Subject: Re: [OVAL-DEVELOPER-LIST] Access Vulnerability Database with Java

This has been discussed at the last two ITSAC conference and the Winter
Developer Days last year.  Discussions have been had around the needs on the
SACM list as well.   This is an effort to get a standard means for
distributing SCAP related content within an organization and as a
potentially federated means of managing content developed by guidance
authors such as CIS, NIST, other government entities and industry verticals.

http://www.google.com/url?sa=t
<http://www.google.com/url?sa=t&rct=j&q=&esrc=s&source=web&cd=2&ved=0CDAQFjA
B&url=http%3A%2F%2Fscap.nist.gov%2Fevents%2F2011%2Fsaddsp%2Fpresentations%2F
Kent_Landfield-Automation_Content_Repositories.pdf&ei=nlOcT-P7L8aWiAKGo6GTAQ
&usg=AFQjCNHvTNEztVQmZhkisLkdcB58EpS8Sw&sig2=HY5JjENzc4wMe2tVc4inAA>
&rct=j&q=&esrc=s&source=web&cd=2&ved=0CDAQFjAB&url=http%3A%2F%2Fscap.nist.go
v%2Fevents%2F2011%2Fsaddsp%2Fpresentations%2FKent_Landfield-Automation_Conte
nt_Repositories.pdf&ei=nlOcT-P7L8aWiAKGo6GTAQ&usg=AFQjCNHvTNEztVQmZhkisLkdcB
58EpS8Sw&sig2=HY5JjENzc4wMe2tVc4inAA

http://scap.nist.gov/events/2011/saddsp/presentations/Security_Automation_Co
ntent_Repository_Demo.pdf

http://scap.nist.gov/events/2011/itsac/presentations/day3/Landfield,%20Chern
in,%20Basavanna%20-%20Content%20Repositories.pdf  

There was also a presentation that Adam Montville prepared for the IETF SACM
Side meeting. They are available in the zip file of the presentations
located in http://www.ietf.org/mail-archive/web/sacm/current/msg00178.html 

Kent Landfield

Direct: +1.972.963.7096 
Mobile: +1.817.637.8026
Web: www.mcafee.com <http://www.mcafee.com/> 

From: David Solin <[email-masked]>
Reply-To: "OVAL Developer List (Closed Public Discussion)"
<[email-masked]>
To: "[email-masked]"
<[email-masked]>
Subject: Re: [OVAL-DEVELOPER-LIST] Access Vulnerability Database with Java

We'd certainly be interested in implementing any such standard.  Can you
point me to who's actively discussing it?  Does MITRE intend to support any
standard approaches to repository access?

Regards,
--David

You know there is talk of producing a standard spec (sacm) to do something
like this.  I know we are busy but something to think about. 

It would be cool to joval be able to directly query and pull down content
directly from SecPod and other repositories in a common way.

-ln

jOVAL provides a ready-to-use JAXB data model for the OVAL language, various
utility classes, and of course, an evaluation engine and scan plug-ins.  It
does not, however, implement access to any on-line repositories.

Regards,
--David Solin

-- 

jOVAL.org: OVAL implemented in Java.
Scan any machine from any machine. For free!
 <http://www.joval.org/> Learn More |  <http://www.joval.org/features/>
Features |  <http://www.joval.org/download/> Download 

Hi There,

 

Thanks and kind regards
 
To unsubscribe, send an email message to [email-masked] with
SIGNOFF OVAL-DEVELOPER-LIST
in the BODY of the message.  If you have difficulties, write to
[email-masked].

To unsubscribe, send an email message to [email-masked] with
SIGNOFF OVAL-DEVELOPER-LIST in the BODY of the message. If you have
difficulties, write to [email-masked]. 

To unsubscribe, send an email message to [email-masked] with
SIGNOFF OVAL-DEVELOPER-LIST in the BODY of the message. If you have
difficulties, write to [email-masked]. 

-- 

jOVAL.org: OVAL implemented in Java.
Scan any machine from any machine. For free!
 <http://www.joval.org> Learn More |  <http://www.joval.org/features/>
Features |  <http://www.joval.org/download/> Download

To unsubscribe, send an email message to [email-masked] with
SIGNOFF OVAL-DEVELOPER-LIST in the BODY of the message. If you have
difficulties, write to [email-masked]. 

To unsubscribe, send an email message to [email-masked] with
SIGNOFF OVAL-DEVELOPER-LIST in the BODY of the message. If you have
difficulties, write to [email-masked]. 

To unsubscribe, send an email message to [email-masked] with
SIGNOFF OVAL-DEVELOPER-LIST in the BODY of the message. If you have
difficulties, write to [email-masked].

---

From: David Solin <[email-masked]>
Date: Wed, 02 May 2012 18:56:34 -0500

Hi David,

Will this project include a reference client implementation?  Will your 
team be seeking comments on the REST and SOAP interfaces?

Regards,
--David Solin

On 5/2/2012 6:34 PM, Michael Hammer wrote:
> *From:[email-masked] [mailto:[email-masked]] *On Behalf 
> Of *Waltermire, David A.
> *Sent:* Wednesday, May 02, 2012 5:34 PM
> *To:* OVAL Developer List (Closed Public Discussion); [email-masked]
> *Subject:* Re: [sacm] [OVAL-DEVELOPER-LIST] Access Vulnerability 
> Database with Java
>
> update on some projects my team has been working on in this area.  We 
> are currently working on the following activities:
>
> 1)Prototyping a federated, generalized XML-based content repository 
> database and the entity and relationship information in a 
> non-relational RDF database.  We can also request the content back out 
> of the datastore and reconstitute it.  The approach we are using does 
> not perturb the underlying XML infoset, so signatures can be verified 
> for content retrieved out of the repository.
>
> We are currently working on web service (SOAP and REST) interfaces and 
> a generalized query language.  Our current development phase will end 
> in the next couple months.  We hope to have a downloadable demo 
> available before Security Automation Developer Days in early July that 
> will support requesting an SCAP datastream or a collection of 
> OVAL/OCIL definitions (and related components) by identifier and version.
>
> <http://www.ietf.org/rfc/rfc2782.txt>) to locate the repository that 
> is responsible for the content identified.  This can be used to 
> dynamically retrieve the referenced content.  We are just starting to 
> work out an XML format for repository-to-repository information 
> exchange to enable this communication.
>
> At this point our current repository code is not far from replacing 
> the data backend that is used for the OVAL repository.  The cool thing 
> about the overall approach is that no OVAL specific code is 
> necessary.  We have created XML-based shredding rules for SCAP 
> datastream, OVAL 5.10.1 and XCCDF 1.2 formats.  It is fairly trivial 
> to create new shredding rules for additional models.
>
> The documentation is very sparse and the code needs some cleanup.  We 
> plan to work on this in the near future.  Our long-term goal is to 
> provide a freely available, production capable content repository 
> server that can participate in a federated network of content servers.
>
> 2)We have also been working on a content repository specification.  
> The goal for this document is to describe the overall federation 
> approach and to detail the data exchange models, interfaces and 
> transports needed to support interoperability.  I plan to have a draft 
> of this specification ready in September.  I would be happy to submit 
> this as an individual submission to the IETF when it is more complete.
>
> My hope is that this work will address many of the communities 
> challenges in this area.  I'd appreciate any thoughts or feedback on 
> this overall approach.  Please let me know if you have any questions.  
> I have also requested a session at the Security Automation Developer 
> Days hosted by MITRE in early July to review and discuss this work in 
> greater detail.
>
> Sincerely,
>
> Dave Waltermire
>
> *From:*Kent Landfield [mailto:[email-masked]] 
> <mailto:[mailto:[email-masked]]>
> *Sent:* Saturday, April 28, 2012 6:17 PM
> *To:* [email-masked] 
> <mailto:[email-masked]>
> *Subject:* Re: [OVAL-DEVELOPER-LIST] Access Vulnerability Database 
> with Java
>
> ;-)
>
> This is one of the topics I would like to see developed on the *SACM* 
> list.
>
> ;-)
>
> *Kent Landfield*
> *McAfee | An Intel Company*
> 5000 Headquarters Dr.
> Plano, Texas 75024
>
> Direct: +1.972.963.7096
> Mobile: +1.817.637.8026
> *Web: *www.mcafee.com <http://www.mcafee.com/>
>
> *From: *<Landfield>, Kent Landfield <[email-masked] 
> <mailto:[email-masked]>>
> *Reply-To: *"OVAL Developer List (Closed Public Discussion)" 
> <[email-masked] 
> <mailto:[email-masked]>>
> *To: *"[email-masked] 
> <mailto:[email-masked]>" 
> <[email-masked] 
> <mailto:[email-masked]>>
> *Subject: *Re: [OVAL-DEVELOPER-LIST] Access Vulnerability Database 
> with Java
>
>     This has been discussed at the last two ITSAC conference and the
>     Winter Developer Days last year.  Discussions have been had around
>     the needs on the SACM list as well.   This is an effort to get a
>     standard means for distributing SCAP related content within an
>     organization and as a potentially federated means of managing
>     content developed by guidance authors such as CIS, NIST, other
>     government entities and industry verticals.
>
>     <http://www.google.com/url?sa=t&rct=j&q=&esrc=s&source=web&cd=2&ved=0CDAQFjAB&url=http%3A%2F%2Fscap.nist.gov%2Fevents%2F2011%2Fsaddsp%2Fpresentations%2FKent_Landfield-Automation_Content_Repositories.pdf&ei=nlOcT-P7L8aWiAKGo6GTAQ&usg=AFQjCNHvTNEztVQmZhkisLkdcB58EpS8Sw&sig2=HY5JjENzc4wMe2tVc4inAA>
>
>     There was also a presentation that Adam Montville prepared for the
>     IETF SACM Side meeting. They are available in the zip file of the
>     presentations located in
>     http://www.ietf.org/mail-archive/web/sacm/current/msg00178.html
>
>     *Kent Landfield*
>     *McAfee | An Intel Company*
>     5000 Headquarters Dr.
>     Plano, Texas 75024
>
>     Direct: +1.972.963.7096
>     Mobile: +1.817.637.8026
>     *Web: *www.mcafee.com <http://www.mcafee.com/>
>
>     *From: *David Solin <[email-masked] <mailto:[email-masked]>>
>     *Reply-To: *"OVAL Developer List (Closed Public Discussion)"
>     <[email-masked]
>     <mailto:[email-masked]>>
>     *To: *"[email-masked]
>     <mailto:[email-masked]>"
>     <[email-masked]
>     <mailto:[email-masked]>>
>     *Subject: *Re: [OVAL-DEVELOPER-LIST] Access Vulnerability Database
>     with Java
>
>         We'd certainly be interested in implementing any such
>         standard.  Can you point me to who's actively discussing it? 
>         Does MITRE intend to support any standard approaches to
>         repository access?
>
>         Regards,
>         --David
>
>         You know there is talk of producing a standard spec (sacm) to
>         do something like this.  I know we are busy but something to
>         think about.
>
>         It would be cool to joval be able to directly query and pull
>         down content directly from SecPod and other repositories in a
>         common way.
>
>         -ln
>
>         jOVAL provides a ready-to-use JAXB data model for the OVAL
>         language, various utility classes, and of course, an
>         evaluation engine and scan plug-ins.  It does not, however,
>         implement access to any on-line repositories.
>
>         jOVAL.org <http://jOVAL.org>: OVAL implemented in Java.
>         /Scan any machine from any machine. For free!/
>         Learn More <http://www.joval.org/> | Features
>         <http://www.joval.org/features/> | Download
>         <http://www.joval.org/download/>
>
>
>         To unsubscribe, send an email message [email-masked]  <mailto:[email-masked]>  with
>
>         in the BODY of the message.  If you have difficulties, write [email-masked]  <mailto:[email-masked]>.
>
>         To unsubscribe, send an email message to
>         [email-masked] <mailto:[email-masked]>
>         with SIGNOFF OVAL-DEVELOPER-LIST in the BODY of the message.
>         If you have difficulties, write to
>         [email-masked]
>         <mailto:[email-masked]>.
>
>         To unsubscribe, send an email message to
>         [email-masked] <mailto:[email-masked]>
>         with SIGNOFF OVAL-DEVELOPER-LIST in the BODY of the message.
>         If you have difficulties, write to
>         [email-masked]
>         <mailto:[email-masked]>.
>
>         -- 
>
>         /Scan any machine from any machine. For free!/
>         Learn More <http://www.joval.org> | Features
>         <http://www.joval.org/features/> | Download
>         <http://www.joval.org/download/>
>
>         To unsubscribe, send an email message to
>         [email-masked] <mailto:[email-masked]>
>         with SIGNOFF OVAL-DEVELOPER-LIST in the BODY of the message.
>         If you have difficulties, write to
>         [email-masked]
>         <mailto:[email-masked]>.
>
>     To unsubscribe, send an email message to [email-masked]
>     <mailto:[email-masked]> with SIGNOFF OVAL-DEVELOPER-LIST
>     [email-masked]
>     <mailto:[email-masked]>.
>
> To unsubscribe, send an email message to [email-masked] 
> <mailto:[email-masked]> with SIGNOFF OVAL-DEVELOPER-LIST in 
> the BODY of the message. If you have difficulties, write to 
> [email-masked] 
> <mailto:[email-masked]>.
>
>
>
> _______________________________________________
> sacm mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/sacm

-- 

jOVAL.org: OVAL implemented in Java.
/Scan any machine from any machine. For free!/
Learn More <http://www.joval.org> | Features 
<http://www.joval.org/features/> | Download 
<http://www.joval.org/download/>

---

From: "Waltermire, David A." <[email-masked]>
Date: Wed, 2 May 2012 22:35:01 -0400

None that I am aware of. This work will be released in the public domain.
Dave

________________________________
From: Michael Hammer <[email-masked]>
To: Waltermire, David A.; [email-masked] <[email-masked]>; [email-masked] <[email-masked]>
Sent: Wed May 02 19:34:20 2012
Subject: RE: [sacm] [OVAL-DEVELOPER-LIST] Access Vulnerability Database with Java

David,

Mike

From: [email-masked] [mailto:[email-masked]] On Behalf Of Waltermire, David A.
Sent: Wednesday, May 02, 2012 5:34 PM
To: OVAL Developer List (Closed Public Discussion); [email-masked]
Subject: Re: [sacm] [OVAL-DEVELOPER-LIST] Access Vulnerability Database with Java

With some of the current email discussion, I’d like to provide a brief update on some projects my team has been working on in this area.  We are currently working on the following activities:

1)      Prototyping a federated, generalized XML-based content repository approach.  The current effort is using a metamodel to describe the key objects (called “entities”) in an XML model and the content references (called “relationships”) that exist within an XML document.  We have developed a shredder that reads in an XML instance, breaking down the entities and relationships.  It then persists the XML chunks in an XML database and the entity and relationship information in a non-relational RDF database.  We can also request the content back out of the datastore and reconstitute it.  The approach we are using does not perturb the underlying XML infoset, so signatures can be verified for content retrieved out of the repository.

Can be retrieved by the content server “oval.mitre.org”.

My hope is that this work will address many of the communities challenges in this area.  I’d appreciate any thoughts or feedback on this overall approach.  Please let me know if you have any questions.  I have also requested a session at the Security Automation Developer Days hosted by MITRE in early July to review and discuss this work in greater detail.

Sincerely,
Dave Waltermire

From: Kent Landfield [mailto:[email-masked]]<mailto:[mailto:[email-masked]]>
Sent: Saturday, April 28, 2012 6:17 PM
To: [email-masked]<mailto:[email-masked]>
Subject: Re: [OVAL-DEVELOPER-LIST] Access Vulnerability Database with Java

;-)

As was properly pointed out to me …there was a typo in my message…

Should have been…

;-)

Kent Landfield

Direct: +1.972.963.7096
Mobile: +1.817.637.8026

Kent Landfield

Direct: +1.972.963.7096
Mobile: +1.817.637.8026

Regards,
--David

-ln

Regards,
--David Solin
--

Hi There,

else, like e.g. OVAL.

Thanks and kind regards

--

---

From: "Waltermire, David A." <[email-masked]>
Date: Thu, 3 May 2012 09:35:09 -0400

Yes.  We plan to provide a Java client resolver API and a command line utility similar to DNS.  We will also be seeking comments on the service interfaces once we have some running code and documentation.

Sincerely,
Dave

From: [email-masked] [mailto:[email-masked]] On Behalf Of David Solin
Sent: Wednesday, May 02, 2012 7:57 PM
To: [email-masked]
Subject: Re: [sacm] [OVAL-DEVELOPER-LIST] Access Vulnerability Database with Java

Hi David,

Will this project include a reference client implementation?  Will your team be seeking comments on the REST and SOAP interfaces?

Regards,
--David Solin

Mike

From: [email-masked]<mailto:[email-masked]> [mailto:[email-masked]] On Behalf Of Waltermire, David A.
Sent: Wednesday, May 02, 2012 5:34 PM
To: OVAL Developer List (Closed Public Discussion); [email-masked]<mailto:[email-masked]>
Subject: Re: [sacm] [OVAL-DEVELOPER-LIST] Access Vulnerability Database with Java

Sincerely,
Dave Waltermire

;-)

Should have been...

;-)

Kent Landfield

Direct: +1.972.963.7096
Mobile: +1.817.637.8026

Kent Landfield

Direct: +1.972.963.7096
Mobile: +1.817.637.8026

Regards,
--David

-ln

Regards,
--David Solin
--

Hi There,

else, like e.g. OVAL.

Thanks and kind regards

--

sacm mailing list

[email-masked]<mailto:[email-masked]>

--

---

From: Luis Nunez <[email-masked]>
Date: Thu, 3 May 2012 12:56:37 -0400

Hi Dave,
Thanks for the update on the prototype repository.  Does this effort fall into the use case:
 "3.4.  UC4: Secure Exchange of Governance, Risk and Compliance (GRC) Information

   Sharing security and/or operationally relevant information within and
   across trust boundaries using secure, automated communication
   channels and formats."

I see this prototype as a building block in achieving this use case.  

What do others think.

-ln

On May 3, 2012, at 9:35 AM, Waltermire, David A. wrote:

> The plan is to use this to lookup a DNS SRV record (RFC 2782) to locate the repository that is responsible for the content identified.  This can be used to dynamically retrieve the referenced content.  We are just starting to work out an XML format for repository-to-repository information exchange to enable this communication.
>  
> Web: www.mcafee.com
> Reply-To: "OVAL Developer List (Closed Public Discussion)" <[email-masked]>
> To: "[email-masked]" <[email-masked]>
> Web: www.mcafee.com
> Reply-To: "OVAL Developer List (Closed Public Discussion)" <[email-masked]>
> To: "[email-masked]" <[email-masked]>
> Learn More | Features | Download
> 
> 
> in the BODY of the message.  If you have difficulties, write to [email-masked].
>  
> To unsubscribe, send an email message to [email-masked] with SIGNOFF OVAL-DEVELOPER-LIST in the BODY of the message. If you have difficulties, write to [email-masked].
>  
> To unsubscribe, send an email message to [email-masked] with SIGNOFF OVAL-DEVELOPER-LIST in the BODY of the message. If you have difficulties, write to [email-masked].
>  
> 
> --
> Learn More | Features | Download
> 
> To unsubscribe, send an email message to [email-masked] with SIGNOFF OVAL-DEVELOPER-LIST in the BODY of the message. If you have difficulties, write to [email-masked].
> To unsubscribe, send an email message to [email-masked] with SIGNOFF OVAL-DEVELOPER-LIST in the BODY of the message. If you have difficulties, write to [email-masked].
> To unsubscribe, send an email message to [email-masked] with SIGNOFF OVAL-DEVELOPER-LIST in the BODY of the message. If you have difficulties, write to [email-masked].
> 
> 
> 
> Learn More | Features | Download
>

---

From: "Waltermire, David A." <[email-masked]>
Date: Thu, 3 May 2012 13:53:02 -0400

Yes.  It can store and exchange any XML based information.  Our approach works well for querying information that changes fairly infrequently and has associated persistent identifiers (e.g. security automation content).  For more dynamic information like reports, the methodology used by the content repository might not be well suited.  I see content repositories less as a silver bullet for this use case, but more as another tool in our tool belt for dealing with this use case.

Sincerely,
Dave

From: Luis Nunez [mailto:[email-masked]]
Sent: Thursday, May 03, 2012 12:57 PM
To: Waltermire, David A.
Cc: David Solin; [email-masked]; OVAL Developer List (Closed Public Discussion) ([email-masked])
Subject: Re: [sacm] [OVAL-DEVELOPER-LIST] Access Vulnerability Database with Java

Hi Dave,

What do others think.

-ln

Sincerely,
Dave

From: [email-masked]<mailto:[email-masked]> [mailto:[email-masked]]<mailto:[mailto:[email-masked]]> On Behalf Of David Solin
Sent: Wednesday, May 02, 2012 7:57 PM
To: [email-masked]<mailto:[email-masked]>
Subject: Re: [sacm] [OVAL-DEVELOPER-LIST] Access Vulnerability Database with Java

Hi David,

Regards,
--David Solin

Mike

Sincerely,
Dave Waltermire

;-)

Should have been...

;-)

Kent Landfield

Direct: +1.972.963.7096
Mobile: +1.817.637.8026

Kent Landfield

Direct: +1.972.963.7096
Mobile: +1.817.637.8026

Regards,
--David

-ln

Regards,
--David Solin
--

Hi There,

else, like e.g. OVAL.

Thanks and kind regards

--

sacm mailing list

--