Section 23.224 Security Content Automation and Protocol (SCAP)

Question 1

Security Content Automation and Protocol (SCAP)

Answer 1

Suite of open standards that enhances the automation of vulnerability management, measurement, and policy compliance evaluation of systems deployed in an organisation

■ Developed by the National Institute of Standards and Technology (NIST)

■ Enhances the automation of security tasks, including the following…
● Vulnerability scanning
● Configuration checking
● Software inventory

Question 2

Components of SCAP

Answer 2

SCAP comprises a suite of open standards used to automate security tasks

■ Supports standardised vulnerability scanning, results reporting, and scoring

■ Promotes vulnerability prioritisation and compliance with internal and external requirements

■ Ensures that different security tools communicate using the same SCAP formatted data

Question 3

SCAP Languages

OVAL (Open Vulnerability and Assessment Language)

Answer 3

XML schema for describing system security states and querying
vulnerability reports

Question 4

SCAP Languages

XCCDF (Extensible Configuration Checklist Description Format)

Answer 4

XML schema for developing and auditing best-practice configuration
checklists and rules

● Allows improved automation

Question 5

SCAP Languages

ARF (Asset Reporting Format)

Answer 5

XML schema for expressing information about assets and their
relationships

● Vendor and technology neutral
● Flexible
● Suited for a wide variety of reporting applications

Question 6

Enumeration Methods in SCAP

CCE (Common Configuration Enumeration)

Answer 6

Scheme for provisioning secure configuration checks across multiple sources

● Provides unique identifiers for different system configuration issues

Question 7

Enumeration Methods in SCAP

CPE (Common Platform Enumeration)

Answer 7

Identifies hardware devices, operating systems, and applications

● Standard format: cpe:/part:vendor:product:version:update:edition:language

EternalBlue
Wannacry ransomware

Question 8

Enumeration Methods in SCAP

CVE (Common Vulnerabilities and Exposures)

Answer 8

Describes publicly known vulnerabilities with unique identifiers

● Standard format:
○ CVE-Year first documented-Number
○ CVE-2017-0144

Question 9

Enumeration Methods in SCAP

Common Vulnerability Scoring System (CVSS)

Answer 9

Used to provide a numerical score reflecting the severity of a vulnerability (0 to 10)

■ Scores are used to categorize vulnerabilities as none, low, medium, high, or critical

■ Scores assist in prioritising remediation efforts but do not account for existing mitigations

0 = none (IN TERMS OF CRITICALITY)

0.1 - 3.9 (LOW)
4.0 - 6.9 (MEDIUM)
7.0 - 8.9 (HIGH)
9.0 - 10.0 (CRITICAL)

Question 10

SCAP Benchmarks

Benchmarks

Answer 10

● Sets of security configuration rules for specific products to establish security baselines

● Provide a detailed checklist that can be used to secure systems to a specific baseline

■ Expressed in the XCCDF format and used for compliance testing

■ Many SCAP Benchmarks available for different systems and applications, ensuring proper system configuration and vulnerability identification

Question 11

Examples of SCAP Benchmarks

Red Hat Enterprise Linux Benchmark

Answer 11

Provides security configuration rules for Red Hat Enterprise Linux

● CIS Microsoft Windows 10 Enterprise Benchmark

○ Includes security configuration rules for Microsoft Windows 10 Enterprise

Question 12

Three languages used in SCAP

Answer 12

● OVAL
● XCCDF
● ARF