Re: [sacm] Identifying Vulnerability Assessment Code

[Adam Montville <[e-mail]>]

Great, thanks for attaching it to this thread also; sorry I didn't do that
up front.

Adam

On Fri, May 19, 2017 at 9:01 AM Waltermire, David A. (Fed) <
[e-mail]> wrote:

> I mentioned this in another thread.
>
>
>
> I can bring some software that has a SWID tag and a CoSWID tag bundled
> that can be installed on a device. I can even provide multiple versions of
> the same software to simulate a release -> vulnerability -> update/patch
> cycle.
>
>
>
> Regards,
>
> Dave
>
>
>
> *From:* sacm [mailto:[e-mail]] *On Behalf Of *Adam Montville
> *Sent:* Friday, May 19, 2017 9:53 AM
> *To:* [e-mail]
> *Subject:* Re: [sacm] Identifying Vulnerability Assessment Code
>
>
>
> I'm resending this call to the list. We have some contributions already
> indicated, but we could use more. Specifically, we don't have an endpoint
> repository at this point. Does anyone have any ideas of what we might use
> for that?
>
>
>
> I know there are some free/open source tools out there targeting
> endpoint/asset management. Here's a list of a few of them:
>
>    - Assetview: https://www.qualys.com/free-tools-trials/
>    - NEWT Professional Network Inventory:
>    http://www.komodolabs.com/network-inventory/
>    - OCS Inventory-NG: http://www.ocsinventory-ng.org/en/
>    - Open-AudIT: http://www.open-audit.org/
>    - Snipe-IT: https://snipeitapp.com/
>
>
>
> CIS will provide an operational environment with endpoints in AWS.
>
>
>
> Kind regards,
>
>
>
> Adam
>
> On Tue, May 16, 2017 at 8:07 AM Adam Montville <[e-mail]>
> wrote:
>
> All:
>
>
>
> Last week a list of goals were sent to this list [1]. I did see some
> back-channel conversation, but nothing that made its way to the list. Then,
> those are our stated goals, and it is now time to start considering what
> code may already exist for our agreed upon components. Once again, these
> components are listed at [2] and repeated here:
>
>
>
> * Vulnerability Detection Data Repository
>
> * Vulnerability Assessor
>
> * Endpoint Repository
>
> * Collector
>
> * Target Endpoint
>
> * Assessment Results Repository
>
>
>
> We need to drive this to some conclusion relatively quickly. If you have
> or know of components filling these roles, please respond by the end of
> this week. Note that the target endpoint component will likely be
> determined based on which real-world vulnerability(ies) we choose to deal
> with as part of this exercise.
>
>
>
> Kind regards,
>
>
>
> Adam
>
>
>
>
>
> [1] https://mailarchive.ietf.org/arch/msg/sacm/LskQ7tj9Wvy1-0DSlEN_VakYj64
>
>
> [2] https://mailarchive.ietf.org/arch/msg/sacm/w_kL2vzDBPk0NN9N1WQcpb3Qwfw
>
>
>