Re: [scap_interest] Operational Aspects

Red Hat might have one for their systems as well.

Also, I think that continuous monitoring has an important role to play
here with their content repository interface specifications.

Adam

On 2/16/12 9:54 AM, "Luis Nunez" <lnunez@c3isecurity.com> wrote:

>Since you mentioned "NVD" also known as the National Vulnerability
>Database.  I think at some point the IETF will be helpful in creating a
>protocol to communicate with these content repositories.  Last I counted
>was 7 content repositories.
>In no particular order and I am sure there are more out there.
>
>-SecPod
>-Novell
>-NVD
>-IT Security Database
>-Debian 
>-Altx-soft
>
>-ln
>
>  
>On Feb 14, 2012, at 5:18 PM, Adam Montville wrote:
>
>> Fair enough.  Just throwing things against the wall as they come to
>>mind.
>> 
>> Adam
>> 
>> From: kent_landfield
>><kent_landfield@mcafee.com<mailto:kent_landfield@mcafee.com>>
>> Date: Tue, 14 Feb 2012 15:32:38 -0600
>> To: Adam Montville
>><amontville@tripwire.com<mailto:amontville@tripwire.com>>,
>><scap_interest@ietf.org<mailto:scap_interest@ietf.org>>
>> Subject: Re: [scap_interest] Operational Aspects
>> 
>> Adam,
>> 
>> We have more than enough on our plate with the specification / I-D
>>work.  Let's see if we can deal with this in a more appropriate forum. I
>>do not see this as that forum.  My 2centsŠ
>> 
>> Thanks.
>> 
>> Kent Landfield
>> Director Content Strategy, Architecture and Standards
>> 
>> McAfee | An Intel Company
>> 5000 Headquarters Dr.
>> Plano, Texas 75024
>> 
>> Direct: +1.972.963.7096
>> Mobile: +1.817.637.8026
>> Web: www.mcafee.com<http://www.mcafee.com/>
>> 
>> From: Adam Montville
>><amontville@tripwire.com<mailto:amontville@tripwire.com>>
>> Date: Tue, 14 Feb 2012 15:12:51 -0600
>> To: "scap_interest@ietf.org<mailto:scap_interest@ietf.org>"
>><scap_interest@ietf.org<mailto:scap_interest@ietf.org>>
>> Subject: [scap_interest] Operational Aspects
>> 
>> While we're all bantering about on security automation, there's another
>>side to the story.  Are there any operational concerns we might address
>>within a WG should one be formed?  For example, we have, in the United
>>States, NVD hosting a repository of information.  CCE identifiers are
>>moderated and assigned by an operational process.  As new enumerations
>>are published and new types of content are conceived, it's easy to
>>imagine the need for some operational standardization.
>> 
>> Should we consider standardizing some of these processes, and if so
>>would the WG we seek to establish be the appropriate place for that work?
>> 
>> Regards,
>> 
>> Adam W. Montville | Security and Compliance Architect
>> 
>> Direct: 503 276-7661
>> Mobile: 360 471-7815
>> 
>> TRIPWIRE | Take CONTROL
>> http://www.tripwire.com
>> 
>> _______________________________________________
>> scap_interest mailing list
>> scap_interest@ietf.org<mailto:scap_interest@ietf.org>
>> https://www.ietf.org/mailman/listinfo/scap_interest
>> 
>> 
>> _______________________________________________
>> scap_interest mailing list
>> scap_interest@ietf.org
>> https://www.ietf.org/mailman/listinfo/scap_interest
>
>