Getting Started ith OpenSCAP

The Security Content Automation Protocol (SCAP) enables automated vulnerability scanning , measurement and policy compliance evaluation of systems based on a method of using specific standards (managed by NIST). 

It was created to provide a standardized approach to maintain the security of enterprise systems, such as automatically verifying the presence of patches, checking system security configuration settings, and examining systems for signs of compromise.

OpenSCAP is a free implementation of SCAP. The SCAP Security Guide along with SCAP components can be utilized in order to automate continuous security management within an organization.

Almost every OS vendor, including RedHat, Ubuntu, and Oracle, supports SCAP to get an overview of which security vulnerabilities are on your system using OpenSCAP. And every OS vendor will provide OVAL, Open Vulnerability and Assessment Language XML file which cab be used in combination with OpenSCAP to get a quick overview of a system.

The following is a step by step guide of how to produce a report in an Ubuntu OS based on Ubuntu OVAL.

Download and install OpenCAP for Ubuntu:

$ sudo apt install libopenscap8

Verify the oscap tool

$ oscap -V

Download Ubuntu OVAL:

$ wget https://security-metadata.canonical.com/oval/com.ubuntu.$(lsb_release -cs).usn.oval.xml.bz2

Uncompress the data:

$ bunzip2 com.ubuntu.$(lsb_release -cs).usn.oval.xml.bz2

Check the integrity of the OVAL XML:

$ oscap info com.ubuntu.$(lsb_release -cs).usn.oval.xml

Use OpenSCAP to evaluate OVAL against localhost and generate an HTML report:

$ oscap oval eval --report report.html com.ubuntu.$(lsb_release -cs).usn.oval.xml

Lastly, open the report.html with any borwser.

 

report.html

Links:

• How we use Ubuntu OVAL
  

OVAL and CVRF

Open Vulnerability and Assessment Language (OVAL)

An OVAL is a definition file that is designed for use by automated test tools to determine the patch state of a machine. It is developed by NIST.

CVRF is not designed as being a way to determine the patch state of a machine, but it can provide an alternative machine-reacable version of security advisories.

 

Common Vulnerability Reporting Framework (CVRF)

The goal of CVRF is to share information about security updates (security advisories) in an XML machine-readable format. It is developed by ICASI (and is integrated to FIRST in Jun 2021).

CVRF has been transitioned to the OASIS Common Security Advisory Framework (CSAF) Technical Committee.

The most common supported CVRF is v1.1 today.

What are the differences between OVAL and CVRF?

OVAL is a definition file that used by scanning tools to perform assessment, and CVRF is security advisories documents.

OVAL is available as a roll up definition file for OS version, such as Ubuntu Focal. It contains all the patch info since day 1.

CVRF document is usually provided by OS vendor at a regular basis. For example, Microsoft provides a monthly security advisories in CVRF format, and can be retrieved via API call with the parameter 2021-apr.

Think of OVAL is for security scanning (with OpenSCAP), and CVRF is just the security advisories (not for assessment) that used for communicating security information to customers.

Both are in XML format that machine-readable.

Vendor Supports

Most OS vendors support OVAL and provide OVAL download for free. For example, RedHat starts provide OVAL definition since 2006, and starts providing CVRF documents for all RedHat security advisories across all products since 2012.

So far, Microsoft only provide CVRF documents and an API call to access the documents based on the YYYY-mmm.

Links:

• Red Hat and CVRF compatibility
• GitHub OVAL Sandbox
• GitHub CVRF Sandbox
• CVRF GitHub Wedsite 
• MSRC CVRF API