Hi We would like to make OpenVAS an OVAL adopter as the products and projects on this list: http://oval.mitre.org/adoption/productlist.html .
I see only a technical difficulty in doing this for an Open and Free project, although others have done that, like joval (http://oval.mitre.org/adoption/questionnaires/15.html). The questionaires are not really made to cover our kind of structures. To advance in the adoption procedure, certain documents have to be filled out; I attached drafts to this email. How do we best proceed and register OpenVAS there? Should Greenbone Networks GmbH do these steps? Enjoy, Felix
%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%% %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%% %%%%%%%%%%%%% %%%%%%%%%%%%% %%%%%%%%%%%%% PHASE ONE %%%%%%%%%%%%% %%%%%%%%%%%%% %%%%%%%%%%%%% %%%%%%%%%%%%% DECLARATION OF INTENT TO ADOPT OVAL %%%%%%%%%%%%% %%%%%%%%%%%%% VERSION 5 %%%%%%%%%%%%% %%%%%%%%%%%%% %%%%%%%%%%%%% %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%% %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%% The first phase of the OVAL Adoption Program is declaring intent. This declaration is a statement to the OVAL Community regarding future adoption of OVAL in accordance with the technical use cases defined in the in the "OVAL Use Cases" document. http://oval.mitre.org/adoption/usecasesguide.html Once a declaration has been submitted, the OVAL Review Authority will work with the declaring organization to ensure that the information is complete. At this time the declaration of intent will be published on the adoption page on the OVAL web site. http://oval.mitre.org/adoption/ Information provided on this form will only be used for purposes of evaluating an applicant's eligibility to be included in the list of OVAL-Adopters and for generating the material that is put on the adoption page of the OVAL web site. Please direct any questions or concerns to the OVAL Moderator at: o...@mitre.org ----------------------------------------------------------------------------- STEPS TO TAKE ----------------------------------------------------------------------------- The following outlines the steps to take in order to successfully complete the declaration phase of the OVAL Adoption Program. Please adhere to these steps in an effort to save time and avoid common mistakes. 1) Review the OVAL Technical Use Cases and the "Requirements and Recommendations for OVAL Adoption and Use" documents. http://oval.mitre.org/adoption/usecasesguide.html http://oval.mitre.org/adoption/requirements.html 2) Review the declarations of other organizations as posted on the OVAL web site. 3) Ensure that you are willing to provide one or more of the high-level OVAL Validation Capabilities. Each capaility is outlined below. OVAL Authoring Tool: A product that aids in the process of creating new OVAL files (including products that consolidate existing definitions into a single file). OVAL Definition Evaluator: A product that uses an OVAL Definition to guide evaluation and produces OVAL Results (full results) as output. OVAL Definition Repository: A repository of OVAL Definitions made available to the community (free or pay). OVAL System Characteristics Producer: A product that generates a valid OVAL System Characteristics file based on the details of a system. OVAL Results Consumer: A product that accepts OVAL Results as input and either displays those results to the user, or uses the results to perform some action. 4) Fill out the information requested by the form provided below. 5) Email the completed form to o...@mitre.org. ***************************************************************************** ** ** ** OVAL ADOPTION DECLARATION FORM ** ** ** ***************************************************************************** 1) ORGANIZATIONAL INFORMATION -------------------------- A) NAME OF YOUR ORGANIZATION: OpenVAS B) WEB SITE: http://www.openvas.org 2) CONTACT INFORMATION ------------------- A) NAME: TBD B) EMAIL: TBD C) PHONE NUMBER: TBD D) FAX NUMBER: TBD E) STREET MAIL ADDRESS: TBD F) BOOTH COORDINATOR: Not assigned, either contact (A,B,C,D) or (G) G) OTHER POINTS OF CONTACT [e.g. marketing or PR]: Any type of personal correspondence can also be addressed to: TBD Any type of generic correspondence can be addressed to: TBD 3) PRODUCT INFORMATION ------------------- A) PRODUCT/SERVICE NAME: OpenVAS B) PRODUCT/SERVICE TYPE: Vulnerability Management C) PRODUCT/SERVICE HOME PAGE: TBD D) ADOPTION CAPABILITIES: Please pick one or more capability from the following list and include the status regarding that capability. To choose how to answer Yes/Beta/Planned/No please consider: - If currently providing the functionality, choose "Yes." - If it has been implemented but not released, choose "Beta". - If planned but not currently available, choose "Planned". - If there are no plans for the specific category, choose "No" ** OVAL ADOPTION MAY NOT BE DECLARED FOR CAPABILITES ** ** THAT ARE NOT PROVIDED IN THE LIST BELOW. ** <put your product/service adoption capabilities here along with status, if a release date can be provided, please include it> - OVAL Systems Characteristics Producer (Beta) - OVAL Definition Repository (No) - OVAL Authoring Tool (No) - OVAL Definition Evaluator (Beta) - OVAL Results Consumer (Beta) 4) QUOTE/DECLARATION ----------------- A) Please make a short statement about why you are adopting OVAL and about the OVAL functionality you will be implementing. Your quote should be about five lines. Your quote should be specific to the product that you are making this declaration for. For examples, see the other quotes and declarations that are already on the adoption declaration page. OpenVAS is a vulnerability management and vulnerability scanning software framework. A feed service allows regular updates of Network Vulnerability tests (NVTs). The main security scan phase of the application collects security information about each host in the network being scanned. Subsequently, comprehensive OVAL-related processing is possible. This includes exporting system characteristics for the whole network, and applying the applications reporting framework according to OVAL definitions. ***************************************************************************** ** ** ** OVAL ADOPTION DECLARATION FORM ** ** ** ***************************************************************************** *** email the completed form to o...@mitre.org *** %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%% %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%% %%%%%%%%%%%%% %%%%%%%%%%%%% %%%%%%%%%%%%% PHASE ONE %%%%%%%%%%%%% %%%%%%%%%%%%% %%%%%%%%%%%%% %%%%%%%%%%%%% %%%%%%%%%%%%% %%%%%%%%%%%%% DECLARATION OF INTENT TO ADOPT OVAL %%%%%%%%%%%%% %%%%%%%%%%%%% VERSION 5 %%%%%%%%%%%%% %%%%%%%%%%%%% %%%%%%%%%%%%% %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%% %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%% %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%% %%%%%%%%%%%%% %%%%%%%%%%%%% %%%%%%%%%%%%% PHASE THREE %%%%%%%%%%%%% %%%%%%%%%%%%% %%%%%%%%%%%%% %%%%%%%%%%%%% IMPLEMENTATION OF OVAL� CAPABILITY %%%%%%%%%%%%% %%%%%%%%%%%%% VERSION 5 %%%%%%%%%%%%% %%%%%%%%%%%%% %%%%%%%%%%%%% %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%% %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%% After successfully completing the declaration phase of the OVAL Adoption Program and implementing support for the declared OVAL Capabilities the organization is ready for the third phase in the OVAL Adoption Program. This phase involves the completion of the "OVAL Adoption Questionnaire" outlining the use of OVAL and describing the chosen implementation. Remember that the implementation must satisfy the requirements put forth in the "Requirements and Recommendations for OVAL Adoption and Use." https://oval.mitre.org/adoption/requirements.html Once the questionnaire has been submitted, the OVAL Review Authority will work with the submitting organization to ensure that the information is complete. Once completed, the questionnaire will be published on the adoption page on the OVAL web site. https://oval.mitre.org/adoption/participants.html Information provided on this form will only be used for purposes of evaluating an applicant's eligibility to be included in the list of products/services that have implemented support for OVAL and for generating the material that is put on the OVAL web site's adoption page. Please direct any questions or concerns to the OVAL Review Authority at: o...@mitre.org ----------------------------------------------------------------------------- STEPS TO TAKE ----------------------------------------------------------------------------- The following outlines the steps to take in order to successfully complete this questionnaire form as part of the OVAL Adoption Program. Please adhere to these steps in an effort to save time and avoid common mistakes. 1) Review the "Requirements and Recommendations for OVAL Adoption and Use." https://oval.mitre.org/adoption/requirements.html *** NOTE: Throughout the form below you will find that there are often direct references to these requirements in the form of a tag (AR_X.Y) which refers to the adoption requirement X.Y. 2) Review the questionnaires of other organizations as posted on the OVAL web site. 3) Complete the form provided below. 4) Email the completed form to o...@mitre.org. ----------------------------------------------------------------------------- DEFINITIONS ----------------------------------------------------------------------------- The following terms are used throughout this document as they are defined in the "Requirements and Recommendations for OVAL Adoption and Use": Capability, Owner, User, Product, Repository, Correctness Testing, Test Results, and Review Authority. ***************************************************************************** ** ** ** OVAL ADOPTION QUESTIONNAIRE FORM ** ** ** ***************************************************************************** Depending on the type of capability being offered there will be a different number of applicable questions that need answering. Please read the questions carefully and answer all that apply. Screen shots may be used to help demonstrate functionality. The answers submitted below will be reviewed by the OVAL Review Authority and will be posted on the OVAL web site (except where noted otherwise). This is a chance to explain to prospective customers how OVAL has been implemented in the product. ============================================================================= General Capability Questions ============================================================================= The following questions apply to all capabilities. 1) UPDATE ORGANIZATIONAL INFORMATION --------------------------------- Where applicable, provide the name and web site url of the organization that is perusing OVAL Adoption. If not associated with an organization, please just put the name of the individual (AR_1.1) A) NAME OF YOUR ORGANIZATION: OpenVAS B) WEB SITE: http://www.openvas.org C) ORGANIZATION LOGO: Is it ok for your organization logo to be used on the OVAL web site for promoting and announcing that you have adopted OVAL? If so, please provide us with a high-res version of your logo. yes Raster: http://wald.intevation.org/scm/viewvc.php/*checkout*/trunk/doc/logo/OpenVAS-2010-2350x461.png?root=openvas&revision=9562&content-type=text/plain&pathrev=9562 2) UPDATE CONTACT INFORMATION -------------------------- Provide the name and contact information of the individual coordinating with the OVAL Review Authority during the OVAL Adoption Program. A) NAME: TBD B) EMAIL: TBD C) PHONE NUMBER: TBD D) FAX NUMBER: TBD E) MAILING ADDRESS: TBD F) BOOTH COORDINATOR: Not assigned, either contact (A,B,C,D) or (G) G) OTHER POINTS OF CONTACT [e.g. marketing or PR]: TBD 3) UPDATE PRODUCT INFORMATION -------------------------- Please provide the name and related information of the product/service for which this questionnaire applies. A) PRODUCT/SERVICE NAME: OpenVAS B) PRODUCT/SERVICE TYPE: Vulnerability Management C) PRODUCT/SERVICE HOME PAGE: http://www.openvas.org D) ADOPTION CAPABILITIES: Please pick one or more capability from the following list and include the status regarding that capability. When deciding how to respond (Yes/Beta/Planned/No) please consider: - If currently providing the functionality, choose "Yes." - If it has been implemented but not released, choose "Beta". - If planned but not currently available, choose "Planned". - If there are no plans for the specific category, choose "No" ** OVAL ADOPTION MAY NOT BE DECLARED FOR CAPABILITES ** ** THAT ARE NOT PROVIDED IN THE LIST BELOW. ** <put your product/service adoption capabilities here along with status, if a release date can be provided, please include it> - OVAL Systems Characteristics Producer (Yes) - OVAL Definition Repository (No) - OVAL Authoring Tool (No) - OVAL Definition Evaluator (Beta) - OVAL Results Consumer (Beta) 4) TECHNICAL POINT OF CONTACT INFORMATION -------------------------------------- For our internal use, please provide a name, phone number, and email address of the technical point of contact that should be used for coordinating correctness testing. (AR_1.3) A) TECHNICAL POC NAME: TBD B) TECHNICAL POC EMAIL: TBD C) TECHNICAL POC PHONE NUMBER: TBD NOTE: This information will not be posted on the web site 5) PRODUCT ACCESSIBILITY --------------------- Provide a short description of how and where your capability is made available to your customers and the public. (AR_1.9) This functionality is a free service in the form of a feed with multiple interfaces (e.g. http, rsync). The Greenbone Learning Center describes how to use the OVAL functionality. The Learning Center is publicly accessible at the Greenbone website and offers supporting downloads for free. See: http://www.greenbone.net/learningcenter/oval_sc.html 6) LANGUAGE VERSION INDICATION --------------------------- Describe how and where the capability indicates the version of the OVAL Language used to validate, create, or update its content. (AR_1.10) The product supports OVAL Versions 5.3, 5.4, 5.5, 5.6, 5.7, 5.8 and 5.9. ============================================================================= Capability Correctness Statements ============================================================================= The following statements apply to all capabilities. 7) STATEMENT OF ADOPTION -------------------- "As an authorized representative of my organization I agree that we will abide by all of the mandatory adoption requirements as well as all of the additional mandatory adoption requirements that are appropriate for our specific type of capability." (AR_1.2) NAME: TBD TITLE: TBD 8) STATEMENT OF ACCURACY -------------------- "As an authorized representative of my organization and to the best of my knowledge, there are no errors in the correctness of our capability's use of the OVAL Language and the interpretation of the logic." (AR_1.2) NAME: TBD TITLE: TBD 9) STATEMENT ON FOLLOW-ON CORRECTNESS TESTING SUPPORT ------------------------------------------------- "As an authorized representative of my organization, we agree to support the Review Authority in follow-on correctness testing activities, where appropriate types of OVAL documents might need to be exchanged with other organizations attempting to prove the correctness of their capabilities." (AR_1.7) NAME: TBD TITLE: TBD ============================================================================= Capability Correctness Questions ============================================================================= The following questions apply to all capabilities. 10) ERROR REPORTING --------------- Indicate how a user who discovers an error in the capability's use of OVAL can report the error. (AR_2.1) Any reports on potential errors, missing elements or other questions can be submitted via the usual OpenVAS user support channels. 11) RESPONDING TO ERROR REPORTS --------------------------- Describe the approach to responding to the above error reports and how applicable fixes will be applied. (AR_2.2) In case a defect was detected and fixed, the updates can be fetched via the OpenVAS NVT Feed. ============================================================================= Documentation Questions ============================================================================= The following questions apply to all capabilities. 12) ADOPTION DOCUMENTATION ----------------------- Provide a copy, or directions to the location, of where the documentation describes OVAL and OVAL Adoption for any customers. (AR_3.1) The Greenbone Learning Center describes how to use the OVAL functionality. A sample guide for creating and retrieving a OVAL System Characeristics is available here: http://www.greenbone.net/learningcenter/oval_sc.html That page also gives an example on how to run ovaldi using the provided OVAL System Characteristics. 13) LANGUAGE SUPPORT ----------------- Indicate the component schemas and/or individual types of Tests, Objects, States, or Variables that the capability does not support for each capability of OVAL Adoption being applied for. (AR_3.2) The provided System Characteristics are continuously improved and extended. To benefit from those improvements it is not required to update the OpenVAS application. It is important to understand that OpenVAS acts as a remote scanner that is optionally provided with credentials for authenticated analysis. Depending on the granted access for the scanner, the collected System Characteristics may cover only what is obtainable from remote network perspective. Or it can cover all levels of detail in case the scanner was permitted to access the target host systems with suitable permissions. 14) OVAL CONTENT ERROR REPORTING ---------------------------- Provide a copy, or directions to the location, of where the documentation describes the procedure by which errors in OVAL content may be reported for any OVAL content that is produced by the product. (AR_3.3) Any user feedback regarding OVAL System Characteristics, including error reports as well as feature requests, are handled via the standard OpenVAS user support channels. ============================================================================= Content Validity Questions ============================================================================= The following questions apply to all capabilities. 15) SYNTAX ERROR DETECTION AND REPORTING ------------------------------------ Indicate how the product or repository detects and reports syntax errors in any OVAL content that is consumed by the product or repository. (AR_4.1) (AR_4.2) (AR_4.3) (AR_4.4) For producing OVAL System Characteristics, the OpenVAS application does not consume any OVAL content. Should errors occur during producing the System Characteristics, users are informed via the standard methods for problem reporting. ============================================================================= Authoring Tool Capability Questions ============================================================================= The following questions apply to only Authoring Tool capabilities. 16) SEARCH BY ID ------------ Indicate how the user can search for Definitions, Tests, Objects, States, and Variables by ID. (AR_7.1) <put details about how users can search by ID> 17) ENCOURAGE CONTENT REUSE ----------------------- If the product attempts to encourage content reuse, indicate how the product encourages reuse of existing OVAL content. (AR_7.2) <put details about how the product encourages reuse> 18) USER INVOKED VALIDATION ----------------------- If the product supports user invoked content validation, indicate how the user can validate content against the OVAL Language W3C XML Schema and Schematron rules. (AR_7.3) <put details about how users can invoke content validation> 19) CONTENT IMPORT -------------- Indicate how users can import OVAL content into the product. (AR_7.4) <put details about how users can import content> 20) CONTENT EXPORT -------------- Indicate how the product allows users to export OVAL content from the product. (AR_7.5) <put details about how users can export content> 21) DUPLICATE CONTENT DETECTION AND REPORTING ----------------------------------------- If the product detects and reports duplicate content, indicate how the product does this and how the product reports duplicates to the user. (AR_7.6) <put details about how the product detects and reports duplicate content.> 22) CAPABILITY VALUE ---------------- Indicate how the product differs from a standard XML editor and provides additional capability tailored to authoring OVAL content. (AR_7.7) <put details about how users can find syntax error reports> ============================================================================= Definition Evaluator Capability Questions ============================================================================= The following questions apply to only Definition Evaluator capabilities. 23) CONTENT TRANSPARENCY -------------------- Indicate how the product allows users to determine which OVAL Definitions are being evaluated and examine the details of those definitions. (AR_8.1) (AR_8.2) <put details about how users can examine definition details and determine which definitions are being evaluated> 24) CONTENT IMPORT PROCESS EXPLANATION ---------------------------------- If the capability does not support consuming OVAL content at runtime, explain the documented process by which users can submit OVAL content for interpretation by the capability, including how quickly submitted content is made available to the capability. (AR_8.3) <put explanation here> 25) CONTENT EVALUATION ------------------ Indicate how users can review the detailed results of evaluating an OVAL Definition on a target system. (AR_8.4) (AR_8.5) (AR_8.6) (AR_8.7) <put explanation here> 26) FULL OVAL RESULTS ----------------- Indicate how users can review the full OVAL Results of the evaluation of an OVAL Definition on a target system. (AR_8.8) <put explanation here> ============================================================================= Definition Repository Capability Questions ============================================================================= The following questions apply to only Definition Repository capabilities. 27) UNIQUE IDS ---------- Describe the process by which IDs are assigned and managed in the repository and how global uniqueness of IDs is ensured. (AR_6.1) (AR_6.2) (AR_6.3) <put details here> 28) CONTENT VERSIONING ------------------ Describe the process by which the versions of Definitions, Tests, Objects, States, and Variables are managed in the repository. (AR_6.4) <put details here> 29) STANDARD REFERENCES ------------------- Indicate how and when CVE, CCE, and CPE IDs are used as references on OVAL Definitions in the repository. (AR_6.6) (AR_6.7) (AR_6.8) <put details here> 30) CONTENT UPDATES --------------- Describe the process by which users can retrieve content updates. (AR_6.9) <put details here> ============================================================================= Results Consumer Capability Questions ============================================================================= The following questions apply to only Results Consumer capabilities. 31) EXAMINE IMPORTED CONTENT ------------------------ Indicate how users can review OVAL Results that are imported into the product and explain how users can determine which system a particular set of results applies to. (AR_9.1) (AR_9.2) <put explanation here> 32) CONTENT IMPORT PROCESS EXPLANATION ---------------------------------- If the capability does not support consuming OVAL content at runtime, explain the documented process by which users can submit OVAL content for interpretation by the capability, including how quickly submitted content is made available to the capability. (AR_9.3) <put explanation here> ============================================================================= System Characteristics Producer Capability Questions ============================================================================= The following questions apply to only System Characteristics Producer capabilities. 33) COLLECTING SYSTEM DATA ---------------------- Explain the criteria used to collect system data that is included in an OVAL System Characteristics document. (AR_5.2) (AR_5.3) While scanning target systems, the OpenVAS application collects numerous information. After the security scan of a target finished, the host information is used to create an OVAL System Characteristics object. The coverage of the System Characteristics depends on the access grants that were provided for the scan. For example a remote authenticated scan will deliver a far more comprehensive System Characteristics than a remote unauthenticated scan. Among the collected information are for example rpm or dpkg package databases. In general, the collection routine is maintained manually to cover most useful host data while keeping the System Characteristics at a manageable size. The OVAL SC objects are then stored as part of the regular scan results. That means, these can be handled as any other scan result regarding analysis, searching, filtering, annotating, alerting and exporting. 34) CONTENT EXPORT -------------- Indicate how the product allows users to export OVAL System Characteristics documents. (AR_5.2) (AR_5.3) OpenVAS uses a plugin framework for reporting. There are two report plugins for OVAL System Characteristics publicly made available for download: One for single OVAL SC as XML file. And one that creates a zip-archive containing all the OVAL SC XML files each with the target IP address as base name. ***************************************************************************** ** ** ** OVAL ADOPTION QUESTIONNAIRE FORM ** ** ** ***************************************************************************** *** email the completed form to o...@mitre.org *** %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%% %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%% %%%%%%%%%%%%% %%%%%%%%%%%%% %%%%%%%%%%%%% PHASE TWO %%%%%%%%%%%%% %%%%%%%%%%%%% %%%%%%%%%%%%% %%%%%%%%%%%%% IMPLEMENTATION OF OVAL� CAPABILITY %%%%%%%%%%%%% %%%%%%%%%%%%% VERSION 5 %%%%%%%%%%%%% %%%%%%%%%%%%% %%%%%%%%%%%%% %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%% %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
_______________________________________________ Openvas-devel mailing list Openvas-devel@wald.intevation.org http://lists.wald.intevation.org/cgi-bin/mailman/listinfo/openvas-devel