Name of Your Organization:

AdventNet, Inc.

Web Site:

www.adventnet.com

Compatible Capability:

SecureCentral ScanFi

Capability home page:

http://scanfi.com

General Capability Questions

1) Product Accessibility <CR_2.4>

Provide a short description of how and where your capability is made available to your customers and the public (required) :

SecureCentral ScanFi is available as a downloadable .exe (for Windows) and .zip (for Linux) from the website http://scanfi.com . There is a free edition for the product and customers can buy the product license directly from AdventNet or through resellers.

Mapping Questions

4) Map Currency Indication <CR_5.1>

Describe how and where your capability indicates the most recent CVE version used to create or update its mappings (required) :

ScanFi server at the customer locations pulls the most recent vulnerability and exposure definitions from the ScanFi Central Repository Server (CRS) located at the AdventNet site. Typically the ScanFi CRS is updated every week with a set of vulnerability definitions and those include the recent CVE names as well. For more details see http://www.securecentral.com/products/scanfi/architecture.html .

5) Map Currency Update Approach <CR_5.2>

Indicate how often you plan on updating the mappings to reflect new CVE versions and describe your approach to keeping reasonably current with CVE versions when mapping them to your repository (recommended) :

ScanFi server at the customer locations pulls the most recent vulnerability and exposure definitions from the ScanFi Central Repository Server (CRS) located at the AdventNet site. Typically the ScanFi CRS is updated every week with a set of vulnerability definitions and those include the recent CVE names as well. For more details see http://www.securecentral.com/products/scanfi/architecture.html .

6) Map Currency Update Time <CR_5.3>

Describe how and where you explain to your customers the timeframe they should expect an update of your capability's mappings to reflect a newly released CVE version (recommended) :

This is explained in the document http://www.securecentral.com/products/scanfi/architecture.html

Documentation Questions

7) CVE and Compatibility Documentation<CR_4.1>

Provide a copy, or directions to its location, of where your documentation describes CVE and CVE compatibility for your customers (required) :

ScanFi's help documentation is accessible from the product GUI and also available online at http://www.securecentral.com/products/scanfi/help/index.html . The information on CVE compatibility of ScanFi is explained in the Getting Started --> Setting System Parameters --> Vulnerability Database Configuration section ( http://www.securecentral.com/products/scanfi/help/getting_started/system_params/vulnerability_db_config.html ) of the help documentation.

8) Documentation of Finding Elements Using CVE Names <CR_4.2>

Provide a copy, or directions to its location, of where your documentation describes the specific details of how your customers can use CVE names to find the individual security elements within your capability's repository (required):

ScanFi's help documentation is accessible from the product GUI and also available online at http://www.securecentral.com/products/scanfi/help/index.html . The information on how to search on CVE names to locate individual security elements is explained in the Getting Started --> Setting System Parameters --> Vulnerability Database Configuration section ( http://www.securecentral.com/products/scanfi/help/getting_started/system_params/vulnerability_db_config.html ) of the help documentation.

9) Documentation of Finding CVE Names Using Elements <CR_4.3>

Provide a copy, or directions to its location, of where your documentation describes the process a user would follow to find the CVE names associated with individual security elements within your capability's repository (required) :

ScanFi's help documentation is accessible from the product GUI and also available online at http://www.securecentral.com/products/scanfi/help/index.html . The information on how to search get the CVE names based on individual security elements is explained in the Getting Started --> Setting System Parameters --> Vulnerability Database Configuration section ( http://www.securecentral.com/products/scanfi/help/getting_started/system_params/vulnerability_db_config.html ) of the help documentation.

10) Documentation Indexing of CVE-Related Material <CR_4.4>

If your documentation includes an index, provide a copy of the items and resources that you have listed under "CVE" in your index. Alternately, provide directions to where these "CVE" items are posted on your web site (recommended) :

ScanFi documentation does not include an index.

Candidate Support Questions

11) Candidates Versus Entries Indication <CR_6.1>

If CVE candidates are supported or used, explain how you indicate that candidates are not accepted CVE entries (required) :

The CVE candidates in the ScanFi vulnerability database are prefixed with 'CAN' and the accepted entries are prefixed with 'CVE', following the CVE conventions.

12) Candidates Versus Entries Explanation <CR_6.2>

If CVE candidates are supported or used, explain where and how the difference between candidates and entries is explained to your customers (recommended) :

ScanFi's help documentation is accessible from the product GUI and also available online at http://www.securecentral.com/products/scanfi/help/index.html . The explanation on the distinction between the accepted CVE entries and CVE candidates is explained in the Getting Started --> Setting System Parameters --> Vulnerability Database Configuration section ( http://www.securecentral.com/products/scanfi/help/getting_started/system_params/vulnerability_db_config.html ) of the help documentation.

13) Candidate to Entry Promotion <CR_6.3>

If CVE candidates are supported or used, explain your policy for changing candidates into entries within your capability and describe where and how this is communicated to your customers (recommended) :

The ScanFi CRS is updated periodically and this also includes changing CVE candidates to entries. The entries and changes to the ScanFi CRS are notified to the users through the online product discussion forums at http://forums.adventnet.com/viewforum.php?f=67

14) Candidate Mapping Currency Indication <CR_6.6>

If CVE candidates are supported or used, explain where and how a customer can find the explanation of your search function's ability to look for candidates and entries by using just the YYYY-NNNN portion of the CVE names (recommended) :

The ScanFi CRS is updated periodically and this also includes changing CVE candidates to entries. The entries and changes to the ScanFi CRS are notified to the users through the online product discussion forums at http://forums.adventnet.com/viewforum.php?f=67

Type-Specific Capability Questions

Tool Questions

15) Finding Tasks Using CVE Names <CR_A.2.1>

Give detailed examples and explanations of how a user can locate tasks in the tool by looking for their associated CVE name (required) :

This is explained in the screen shots below

Step 1 : Search based on the CVE name in the ScanFi vulnerability knowledge base,




Step 2 : Locate the task associated to the CVE name



Step 3 : Click on the task name to get the details

16) Finding CVE Names Using Elements in Reports <CR_A.2.2>

Give detailed examples and explanations of how, for reports that identify individual security elements, the tool allows the user to determine the associated CVE names for the individual security elements in the report (required) :

This is explained in the screen shot below.

17) Getting a List of CVE Names Associated with Tasks <CR_A.2.4>

Give detailed examples and explanations of how a user can obtain a listing of all of the CVE names that are associated with the tool's tasks (recommended) :

This is explained in the screen shot below. The default vulnerability database view in the ScanFi GUI lists all the tasks and the associated CVE names wherever applicable.

18) Selecting Tasks with a List of CVE Names <CR_A.2.5>

Describe the steps and format that a user would use to select a set of tasks by providing a file with a list of CVE names (recommended) :

This can be accomplished by creating a vulnerability group in ScanFi as explained in the screen shots below.

Step 1 : Get the task list filtered for each CVE name.



Step 2 : Create a new vulnerability group and add the filtered tasks to the group



Step 3 : For other CVE names in the list, get a filtered list of tasks and then add them to the vulnerability group.




Step 4 : This group will consist of the set of tasks corresponding to the list of CVE names.

19) Selecting Tasks Using Individual CVE Names <CR_A.2.6>

Describe the steps that a user would follow to browse, select, and deselect a set of tasks for the tool by using individual CVE names (recommended) :

For browsing and selecting tasks by individual CVE names, the answer to CR_A.2.5 applies. Deselecting a task from a vulnerability group based on individual CVE names is explained  in the screen shot below.

Select the check box corresponding to the CVE name and click on 'Delete from Group'

Media Questions

29) Electronic Document Format Info <CR_B.3.1>

Provide details about the different electronic document formats that you provide and describe how they can be searched for specific CVE-related text (required) :

The ScanFi scan results and reports support HTML and PDF electronic document formats. Both these formats allow for text search of the content.

30) Electronic Document Listing of CVE Names <CR_B.3.2>

If one of the capability's standard electronic documents only lists security elements by their short names or titles provide example documents that demonstrate how the associated CVE names are listed for each individual security element (required) :

There are two places where the scan results show only the short names. The screen shots below explain how the associated CVE names can be found.

Scan result view shows the short description of the vulnerability and on clicking on that a window pops up showing the complete details of the vulnerability including the CVE name.



Scan reports by default show only the vulnerability description and on clicking on that the view drills down to show the complete details of the vulnerability including the CVE name.

31) Electronic Document Element to CVE Name Mapping <CR_B.3.2>

Provide example documents that demonstrate the mapping from the capability's individual elements to the respective CVE name(s) (recommended) :

ScanFi's vulnerability knowledgebase view gives the mapping as explained in CR_A.2.4 .

Graphical User Interface (GUI)

32) Finding Elements Using CVE Names Through the GUI <CR_B.4.1>

Give detailed examples and explanations of how the GUI provides a "find" or "search" function for the user to identify your capability's elements by looking for their associated CVE name(s) (required) :

This is explained in the screen shot below.

33) GUI Element to CVE Name Mapping <CR_B.4.2>

Briefly describe how the associated CVE names are listed for the individual security elements or discuss how the user can use the mapping between CVE entries and the capability's elements, also describe the format of the mapping (required) :

The vulnerability knowledgebase view gives a complete listing of the security elements and the associated CVE names as shown in the screen shot below.

34) GUI Export Electronic Document Format Info <CR_B.4.3>

Provide details about the different electronic document formats that you provide for exporting or accessing CVE-related data and describe how they can be searched for specific CVE-related text (recommended) :

The ScanFi scan results and reports support HTML and PDF electronic document formats. Both these formats allow for text search of the content.

Questions for Signature

35) Statement of Compatibility <CR_2.7>

Have an authorized individual sign and date the following Compatibility Statement (required) :

"As an authorized representative of my organization I agree that we will abide by all of the mandatory CVE Compatibility Requirements as well as all of the additional mandatory CVE Compatibility Requirements that are appropriate for our specific type of capability."

Name: G. Rajesh

Title: Director of Product Management

36) Statement of Accuracy <CR_3.4>

Have an authorized individual sign and date the following accuracy Statement (recommended) :

"As an authorized representative of my organization and to the best of my knowledge, there are no errors in the mapping between our capability's Repository and the CVE entries our capability identifies."

Name: G. Rajesh

Title: Director of Product Management

37) Statement on False-Positives and False-Negatives <CR_A.2.8 and/or CR_A.3.5>

FOR TOOLS ONLY - Have an authorized individual sign and date the following statement about your tools efficiency in identification of security elements (required) :

"As an authorized representative of my organization and to the best of my knowledge, normally when our capability reports a specific security element, it is generally correct and normally when an event occurs that is related to a specific security element our capability generally reports it."

Name: G. Rajesh

Title: Director of Product Management

Use of the Common Vulnerabilities and Exposures List and the associated references from this Web site are subject to the Terms of Use . For more information, please email cve@mitre.org .

Copyright 2005, The MITRE Corporation . CVE and the CVE logo are registered trademarks of The MITRE Corporation.

For more information, please email cve@mitre.org .

Page last updated: Monday, 19-Jun-2006 23:51:41 EDT