Subject: [scap_interest] SCE XCCDF

From: Luis Nunez <[email-masked]>
Date: Fri, 24 Feb 2012 09:57:02 -0500

Link is some interesting and innovated work coming out of the open-scap.org project.  New release includes Script Check Engine (SCE) for XCCDF.

http://pvrabec.livejournal.com/887.html

-ln

---

From: David Solin <[email-masked]>
Date: Fri, 24 Feb 2012 09:54:33 -0600

Thanks for forwarding this Luis, it's very interesting!

We're planning on bundling an XCCDF interpreter with the next release of 
jOVAL, and this would be a great capability to add to that support.  To 
that end, I've reached out to Peter Vrabec to discuss the reporting 
format, and adding variable exports to the "specification" (which seems 
like it would be very easy to do).

Regards,
--David Solin

-- 

jOVAL.org: OVAL implemented in Java.
/Scan any machine from any machine. For free!/
Learn More <http://www.joval.org> | Features 
<http://www.joval.org/features/> | Download 
<http://www.joval.org/download/>

On 2/24/2012 8:57 AM, Luis Nunez wrote:
> _______________________________________________
> scap_interest mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/scap_interest

---

From: "Chandrashekhar B" <[email-masked]>
Date: Fri, 24 Feb 2012 17:14:19 +0000

This is an alternative option to cases where OVAL cannot be used to as a checking language. But there will always be confusion when to use what as the capabilities of OVAL improve. There is certainly one use case, to develop remote checks to determine vulnerabilities, assuming OVAL is not meant for that. Any effort to standardize this interface is good.

Thanks,
Chandra.
Sent from BlackBerry® on Airtel

---

From: "Chernin, Michael A." <[email-masked]>
Date: Fri, 24 Feb 2012 17:54:37 +0000

As a standards content consumer, I would prefer we implement whatever needs to be improved within the OVAL language. As to what needs to be improved, we should probably compile a list and discuss it.

Aharon

DTCC Non-Confidential (White)
---------------------------------------------------
Michael "Aharon" Chernin
Security Automation Program Manager
Corporate Information Security -Depository Trust & Clearing Corporation
O: 813-470-2173

> From: [email-masked] [mailto:scap_interest-
> [email-masked]] On Behalf Of Chandrashekhar B
> Sent: Friday, February 24, 2012 12:14 PM
> To: David Solin; [email-masked]; [email-masked]
> This is an alternative option to cases where OVAL cannot be used to as a
> checking language. But there will always be confusion when to use what as
> the capabilities of OVAL improve. There is certainly one use case, to develop
> remote checks to determine vulnerabilities, assuming OVAL is not meant for
> that. Any effort to standardize this interface is good.
> 
> Thanks,
> Chandra.
> Sent from BlackBerry(r) on Airtel
> 
<BR>_____________________________________________________________
<FONT size=2><BR>
DTCC DISCLAIMER: This email and any files transmitted with it are
confidential and intended solely for the use of the individual or
entity to whom they are addressed. If you have received this email
in error, please notify us immediately and delete the email and any
attachments from your system. The recipient should check this email
and any attachments for the presence of viruses.  The company
accepts no liability for any damage caused by any virus transmitted
by this email.</FONT>