Name of Your Organization:

SecureInfo Corporation

Web Site:

www.secureinfo.com

Compatible Capability:

Risk Management System (RMS)

Capability home page:

http://www.secureinfo.com/

1) Product Accessibility <CR_2.4>

Provide a short description of how and where your capability is made available to your customers and the public (required):

Risk Management System (RMS) is available by direct purchase and through other sources such as prime contractors and integrators.

4) Map Currency Indication <CR_5.1>

Describe how and where your capability indicates the most recent CVE version used to create or update its mappings (required):

The Search Selection Interface and the Vulnerability Assessment Report both include a column titled "Modified" which displays the most recent date that the RMS server was updated CVE information.

5) Map Currency Update Approach <CR_5.2>

Indicate how often you plan on updating the mappings to reflect new CVE versions and describe your approach to keeping reasonably current with CVE versions when mapping them to your repository (recommended):

The RMS server is programmed to automatically contact the NIST NVD site and download CVE files every two hours. The downloaded files are stored in a repository on the RMS server. The download frequency is configurable.

6) Map Currency Update Time <CR_5.3>

Describe how and where you explain to your customers the timeframe they should expect an update of your capability's mappings to reflect a newly released CVE version (recommended):

The online RMS User Guide explains the information in Question 5, in the section on Vulnerabilities, and in the Installation and Maintenance Guide.

7) CVE and Compatibility Documentation<CR_4.1>

Provide a copy, or directions to its location, of where your documentation describes CVE and CVE compatibility for your customers (required):

The online RMS User Guide describes CVE and CVE compatibility. When logged in to RMS, click Help in the Menu bar, then select Contents to display the user guide. CVE is discussed in the Contents section (The User Space/My Folders/Vulnerabilities), by Index search (keywords CVE, Common Vulnerabilities and Exposures, vulnerabilities, VAR), and by keyword search (keywords CVE, Common Vulnerabilities and Exposures, vulnerabilities, VAR).

8) Documentation of Finding Elements Using CVE Names <CR_4.2>

Provide a copy, or directions to its location, of where your documentation describes the specific details of how your customers can use CVE names to find the individual security elements within your capability's repository (required):

The online RMS User Guide describes CVE and CVE compatibility. When logged in to RMS, click Help in the Menu bar, then select Contents to display the user guide. CVE is discussed in the Contents section (The User Space/My Folders/Vulnerabilities), by Index search (keywords CVE, Common Vulnerabilities and Exposures, vulnerabilities, VAR), and by keyword search (keywords CVE, Common Vulnerabilities and Exposures, vulnerabilities, VAR).

9) Documentation of Finding CVE Names Using Elements <CR_4.3>

Provide a copy, or directions to its location, of where your documentation describes the process a user would follow to find the CVE names associated with individual security elements within your capability's repository (required):

The online RMS User Guide describes CVE and CVE compatibility. When logged in to RMS, click Help in the Menu bar, then select Contents to display the user guide. CVE is discussed in the Contents section (The User Space/My Folders/Vulnerabilities), by Index search (keywords CVE, Common Vulnerabilities and Exposures, vulnerabilities, VAR), and by keyword search (keywords CVE, Common Vulnerabilities and Exposures, vulnerabilities, VAR).

10) Documentation Indexing of CVE-Related Material <CR_4.4>

If your documentation includes an index, provide a copy of the items and resources that you have listed under "CVE" in your index. Alternately, provide directions to where these "CVE" items are posted on your web site (recommended):

The online RMS User Guide describes CVE and CVE compatibility. When logged in to RMS, click Help in the Menu bar, then select Contents to display the user guide. CVE is discussed in the Contents section (The User Space/My Folders/Vulnerabilities), by Index search (keywords CVE, Common Vulnerabilities and Exposures, vulnerabilities, VAR), and by keyword search (keywords CVE, Common Vulnerabilities and Exposures, vulnerabilities, VAR).

Type-Specific Capability Questions

15) Finding Tasks Using CVE Names <CR_A.2.1>

Give detailed examples and explanations of how a user can locate tasks in the tool by looking for their associated CVE name (required):

1. Open the User Space.
2. Expand My Folders and open the desired C&A package.
3. Click the Contents tab.
4. Right-click the Vulnerabilities folder and select Associate Vulnerabilities. The Search Selection Interface displays.
5. If you want to search by CVE Name, type the name (such as CVE-2004-0356) in the Keyword(s)field, and leave the Vendor and Product fields blank.
6. If you want to search by keyword, type the word (such as "ActiveX" or "browser")in the Keyword(s) field.
7. Select a vendor and a product from the drop-down list in Search ALL Vendors and Search ALL Products.
8. Click Search. The window displays all matching results.
9. If you searched by CVE Name, RMS shows you all of the technologies that are associated with the CVE name you chose.
10. If you searched by keyword, RMS shows you all of the technologies that are associated with the keyword, vendor, and product you chose.
11. The Search Selection Interface shows you:

• The vulnerability's impact: High, Medium, Low.
• The Product name.
• The vulnerability Name, according to the NIST NVD CVE definition.
• A brief Description of the vulnerability.
• The Date the vulnerability was published.
• The total number of vulnerabilities Found for this category, vendor, and product.

16) Finding CVE Names Using Elements in Reports <CR_A.2.2>

Give detailed examples and explanations of how, for reports that identify individual security elements, the tool allows the user to determine the associated CVE names for the individual security elements in the report (required):

The Vulnerability Assessment Report (VAR) categorizes the vulnerabilities you have associated with your C&A package into a table format. The format includes the element's risk severity, CVE Name, CVE Summary, the product(s) associated with the CVE, and the CVE published date. The report can be exported into .csv format, which is searchable using common methods.

24) Finding Online Capability Tasks Using CVE Names <CR_A.4.1>

Give detailed examples and explanations of how a "find" or "search" function is available to the user to locate tasks in the online capability by looking for their associated CVE name or through an online mapping that links each element of the capability with its associated CVE name(s) (required):

1. Open the User Space.
2. Expand My Folders and open the desired C&A package.
3. Click the Contents tab.
4. Right-click the Vulnerabilities folder and select Associate Vulnerabilities. The Search Selection Interface displays.
5. If you want to search by CVE Name, type the name (such as CVE-2004-0356) in the Keyword(s)field, and leave the Vendor and Product fields blank.
6. If you want to search by keyword, type the word (such as "ActiveX" or "browser")in the Keyword(s) field.
7. Select a vendor and a product from the drop-down list in Search ALL Vendors and Search ALL Products.
8. Click Search. The window displays all matching results.
9. If you searched by CVE Name, RMS shows you all of the technologies that are associated with the CVE name you chose.
10. If you searched by keyword, RMS shows you all of the technologies that are associated with the keyword, vendor, and product you chose.
11. The Search Selection Interface shows you:

• The vulnerability's impact: High, Medium, Low.
• The Product name.
• The vulnerability Name, according to the NIST NVD CVE definition.
• A brief Description of the vulnerability.
• The Date the vulnerability was published.
• The total number of vulnerabilities Found for this category, vendor, and product.

27) Finding CVE Names Using Online Capability Elements <CR_A.4.2>

Give detailed examples and explanations of how, for reports that identify individual security elements, the online capability allows the user to determine the associated CVE names for the individual security elements in the report. (required):

RMS has the capability of producing a Vulnerability Assessment Report (VAR) which categorizes the vulnerabilities you have associated with your C&A package into a table format. The format includes the element's risk severity, CVE Name, CVE Summary, the product(s) associated with the CVE, and the CVE published date. The report can be exported into .csv format, which is searchable using common methods.

28) Online Capability Element to CVE Name Mapping <CR_A.4.3>

If details for individual security elements are not provided, give examples and explanations of how a user can obtain a mapping that links each element with its associated CVE name(s), otherwise enter N/A (required):

RMS has the capability of producing a Vulnerability Assessment Report (VAR) which categorizes the vulnerabilities you have associated with your C&A package into a table format. The format includes the element's risk severity, CVE Name, CVE Summary, the product(s) associated with the CVE, and the CVE published date. The report can be exported into .csv format, which is searchable using common methods.

29) Electronic Document Format Info <CR_B.3.1>

Provide details about the different electronic document formats that you provide and describe how they can be searched for specific CVE-related text (required):

RMS has the capability of producing a Vulnerability Assessment Report (VAR) which categorizes the vulnerabilities you have associated with your C&A package into a table format. The format includes the element's risk severity, CVE Name, CVE Summary, the product(s) associated with the CVE, and the CVE published date. The report can be exported into .csv format, which is searchable using common methods.

30) Electronic Document Listing of CVE Names <CR_B.3.2>

If one of the capability's standard electronic documents only lists security elements by their short names or titles provide example documents that demonstrate how the associated CVE names are listed for each individual security element (required):

N/A

31) Electronic Document Element to CVE Name Mapping <CR_B.3.2>

Provide example documents that demonstrate the mapping from the capability's individual elements to the respective CVE name(s) (recommended):

RMS has the capability of producing a Vulnerability Assessment Report (VAR) which categorizes the vulnerabilities you have associated with your C&A package into a table format. The format includes the element's risk severity, CVE Name, CVE Summary, the product(s) associated with the CVE, and the CVE published date. The report can be exported into .csv format, which is searchable using common methods.

32) Finding Elements Using CVE Names Through the GUI <CR_B.4.1>

Give detailed examples and explanations of how the GUI provides a "find" or "search" function for the user to identify your capability's elements by looking for their associated CVE name(s) (required):

Launch RMS.

1. Open the User Space.
2. Expand My Folders and open the desired C&A package.
3. Click the Contents tab.
4. Right-click the Vulnerabilities folder and select Associate Vulnerabilities. The Search Selection Interface displays.
5. If you want to search by CVE Name, type the name (such as CVE-2004-0356) in the Keyword(s)field, and leave the Vendor and Product fields blank.
6. If you want to search by keyword, type the word (such as "ActiveX" or "browser")in the Keyword(s) field.
7. Select a vendor and a product from the drop-down list in Search ALL Vendors and Search ALL Products.
8. Click Search. The window displays all matching results.
9. If you searched by CVE Name, RMS shows you all of the technologies that are associated with the CVE name you chose.
10. If you searched by keyword, RMS shows you all of the technologies that are associated with the keyword, vendor, and product you chose.
11. The Search Selection Interface shows you:

• The vulnerability's impact: High, Medium, Low.
• The Product name.
• The vulnerability Name, according to the NIST NVD CVE definition.
• A brief Description of the vulnerability.
• The Date the vulnerability was published.
• The total number of vulnerabilities Found for this category, vendor, and product.

33) GUI Element to CVE Name Mapping <CR_B.4.2>

Briefly describe how the associated CVE names are listed for the individual security elements or discuss how the user can use the mapping between CVE entries and the capability's elements, also describe the format of the mapping (required):

The CVE entries are listed in alphanumeric order. The user can sort each of the columns in the VAR in either ascending or descending order. The report can be exported to .csv format, which is searchable by keyword method.

34) GUI Export Electronic Document Format Info <CR_B.4.3>

RMS' Vulnerability Assessment Report (VAR) can be exported into .csv format, which is searchable using common methods.

35) Statement of Compatibility <CR_2.7>

Have an authorized individual sign and date the following Compatibility Statement (required):

"As an authorized representative of my organization I agree that we will abide by all of the mandatory CVE Compatibility Requirements as well as all of the additional mandatory CVE Compatibility Requirements that are appropriate for our specific type of capability."

Name: Roberto R. Garcia

Title: Vice President, Product Engineering

36) Statement of Accuracy <CR_3.4>

Have an authorized individual sign and date the following accuracy Statement (recommended):

"As an authorized representative of my organization and to the best of my knowledge, there are no errors in the mapping between our capability's Repository and the CVE entries our capability identifies."

Name: Roberto R. Garcia

Title: Vice President, Product Engineering

37) Statement on False-Positives and False-Negatives <CR_A.2.8 and/or CR_A.3.5>

FOR TOOLS ONLY - Have an authorized individual sign and date the following statement about your tools efficiency in identification of security elements (required):

"As an authorized representative of my organization and to the best of my knowledge, normally when our capability reports a specific security element, it is generally correct and normally when an event occurs that is related to a specific security element our capability generally reports it."

Name: Roberto R. Garcia

Title: Vice President, Product Engineering