Performing Vulnerability Analysis

Question 1

Security Content Automation Protocol(SCAP)

Answer 1

A NIST framework that outlines various accepted practices for automating vulnerability scanning.

Question 2

Open Vulnerability and Assessment Language(OVAL)

Answer 2

An XML schema, maintained by MITRE, for describing system security state and querying vulnerability reports and information.

Question 3

Common Platform Enumeration(CPE)

Answer 3

Scheme for identifying hardware devices, operating systems, and applications developed by MITRE

Question 4

Common Vulnerabilities and Exposures(CVE)

Answer 4

Scheme for identifying vulnerabilities developed by MITRE and adopted by NIST.

Question 5

Common Configuration Enumeration(CCE)

Answer 5

Scheme for provisioning secure configuration checks across multiple sources developed by MITRE and adopted by NIST.

Question 6

Common Vulnerability Scoring System (CVSS)

Answer 6

A risk management approach to quantifying vulnerability data and then taking into account the degree of risk to different types of systems or information.