Security Automation and Continuous Monitoring M. Cokus Internet-Draft D. Haynes Intended status: Informational D. Rothenberg Expires: September 8, 2016 The MITRE Corporation J. Gonzalez Department of Homeland Security March 7, 2016 OVAL(R) Directives Model draft-rothenberg-sacm-oval-directives-model-00 Abstract This document specifies Version 5.11.1 of the OVAL Directives Model which defines the constructs used to tailor the level of detail contained within a set of OVAL Results. Status of This Memo This Internet-Draft is submitted in full conformance with the provisions of BCP 78 and BCP 79. Internet-Drafts are working documents of the Internet Engineering Task Force (IETF). Note that other groups may also distribute working documents as Internet-Drafts. The list of current Internet- Drafts is at http://datatracker.ietf.org/drafts/current/. Internet-Drafts are draft documents valid for a maximum of six months and may be updated, replaced, or obsoleted by other documents at any time. It is inappropriate to use Internet-Drafts as reference material or to cite them other than as "work in progress." This Internet-Draft will expire on September 8, 2016. Copyright Notice Copyright (c) 2016 IETF Trust and the persons identified as the document authors. All rights reserved. This document is subject to BCP 78 and the IETF Trust's Legal Provisions Relating to IETF Documents (http://trustee.ietf.org/license-info) in effect on the date of publication of this document. Please review these documents carefully, as they describe your rights and restrictions with respect to this document. Code Components extracted from this document must include Simplified BSD License text as described in Section 4.e of Cokus, et al. Expires September 8, 2016 [Page 1] Internet-Draft OVAL Directives Model March 2016 the Trust Legal Provisions and are provided without warranty as described in the Simplified BSD License. Table of Contents 1. Introduction . . . . . . . . . . . . . . . . . . . . . . . . 2 1.1. Requirements Language . . . . . . . . . . . . . . . . . . 2 2. OVAL Directives Model . . . . . . . . . . . . . . . . . . . . 3 3. OVAL Directives Model Schema . . . . . . . . . . . . . . . . 4 4. Intellectual Property Considerations . . . . . . . . . . . . 8 5. Acknowledgements . . . . . . . . . . . . . . . . . . . . . . 8 6. IANA Considerations . . . . . . . . . . . . . . . . . . . . . 9 7. Security Considerations . . . . . . . . . . . . . . . . . . . 9 8. References . . . . . . . . . . . . . . . . . . . . . . . . . 9 8.1. Normative References . . . . . . . . . . . . . . . . . . 9 8.2. Informative References . . . . . . . . . . . . . . . . . 9 Authors' Addresses . . . . . . . . . . . . . . . . . . . . . . . 10 1. Introduction The Open Vulnerability and Assessment Language (OVAL) [OVAL-WEBSITE] is an international, information security community effort to standardize how to assess and report upon the machine state of systems. For over ten years, OVAL has been developed in collaboration with any and all interested parties to promote open and publicly available security content and to standardize the representation of this information across the entire spectrum of security tools and services. OVAL provides an established framework for making assertions about a system's state by standardizing the three main steps of the assessment process: representing the current machine state; analyzing the system for the presence of the specified machine state; and representing the results of the assessment which facilitates collaboration and information sharing among the information security community and interoperability among tools. This draft is the part of the OVAL contribution to the IETF SACM WG that standardizes the representation of the results of an assessment. It is intended to serve as a starting point for the endpoint posture assessment data modeling needs of SACM specifically a capability to specify the level of detail in Evaluation Results. 1.1. Requirements Language The key words "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT", "SHOULD", "SHOULD NOT", "RECOMMENDED", "MAY", and "OPTIONAL" in this document are to be interpreted as described in RFC 2119 [RFC2119]. Cokus, et al. Expires September 8, 2016 [Page 2] Internet-Draft OVAL Directives Model March 2016 2. OVAL Directives Model The OVAL Directives Model is used to control what result information is included in the OVAL Results as well as specify its level of detail. +---------------+---------------------------+-------+---------------+ | Property | Type | Count | Description | +---------------+---------------------------+-------+---------------+ | generator | oval:GeneratorType | 1 | Information | | | | | regarding the | | | | | generation of | | | | | the OVAL | | | | | Directives | | | | | content. The | | | | | timestamp | | | | | property of | | | | | the generator | | | | | MUST | | | | | represent the | | | | | time at which | | | | | the oval_dire | | | | | ctives was | | | | | created. | | | | | | | directives | oval- | 1 | Describes the | | | res:DefaultDirectivesType | | default set | | | | | of directives | | | | | that specify | | | | | the results | | | | | that have | | | | | been included | | | | | in the OVAL | | | | | Results. | | | | | | | class_directi | oval- | 0..5 | Describes the | | ves | res:ClassDirectivesType | | set of | | | | | directives | | | | | that specify | | | | | the class- | | | | | specific | | | | | results that | | | | | have been | | | | | included in | | | | | the OVAL | | | | | Results. | | | | | | | signature | ext:Signature | 0..1 | Mechanism to | Cokus, et al. Expires September 8, 2016 [Page 3] Internet-Draft OVAL Directives Model March 2016 | | | | ensure the | | | | | integrity and | | | | | authenticity | | | | | of the OVAL | | | | | Directives | | | | | content. | +---------------+---------------------------+-------+---------------+ Table 1: oval_directives Construct 3. OVAL Directives Model Schema The XML Schema that implements this OVAL Directives Model can be found below. The following is a description of the elements, types, and attributes that compose the core schema for encoding Open Vulnerability and Assessment Language (OVAL) Directives. Each of the elements, types, and attributes that make up the Core Directives Schema are described in detail and Cokus, et al. Expires September 8, 2016 [Page 4] Internet-Draft OVAL Directives Model March 2016 should provide the information necessary to understand what each object represents. This document is intended for developers and assumes some familiarity with XML. A high level description of the interaction between these objects is not outlined here. Core Directives 5.11.1 4/22/2015 09:00:00 AM Copyright (C) 2010 United States Government. All Rights Reserved. The oval_directives element is the root of an OVAL Directive Document. Its purpose is to bind together the generator and the set of directives contained in the document. The generator section must be present and provides information about when the directives document was compiled and under what version. The optional Signature element allows an XML Signature as defined by the W3C to be attached to the document. This allows authentication and data integrity to be provided to the user. Enveloped signatures are supported. More information about the official Cokus, et al. Expires September 8, 2016 [Page 5] Internet-Draft OVAL Directives Model March 2016 W3C Recommendation regarding XML digital signatures can be found at http://www.w3.org/TR/xmldsig-core/. The required generator section provides information about when the directives document was compiled and under what version. The required directives section presents flags describing what information must be been included in an oval results document. This element represents the default set of directives. These directives apply to all classes of definitions for which there is not a class specific set of directives. The Cokus, et al. Expires September 8, 2016 [Page 6] Internet-Draft OVAL Directives Model March 2016 optional class_directives section presents flags describing what information has been included in the results document for a specific OVAL Definition class. The directives for a particlar class override the default directives. The optional Signature element allows an XML Signature as defined by the W3C to be attached to the document. This allows authentication and data integrity to be provided to the user. Enveloped signatures are supported. More information about the official W3C Recommendation regarding XML digital signatures can be found at http://www.w3.org/TR/xmldsig-core/. The class attribute on class_directives must be unique. Cokus, et al. Expires September 8, 2016 [Page 7] Internet-Draft OVAL Directives Model March 2016 4. Intellectual Property Considerations Copyright (C) 2010 United States Government. All Rights Reserved. DHS, on behalf of the United States, owns the registered OVAL trademarks, identifying the OVAL STANDARDS SUITE and any component part, as that suite has been provided to the IETF Trust. A "(R)" will be used in conjunction with the first use of any OVAL trademark in any document or publication in recognition of DHS's trademark ownership. 5. Acknowledgements The authors wish to thank DHS for sponsoring the OVAL effort over the years which has made this work possible. The authors also wish to thank the original authors of this document Jonathan Baker, Matthew Cokus, et al. Expires September 8, 2016 [Page 8] Internet-Draft OVAL Directives Model March 2016 Hansbury, and Daniel Haynes of the MITRE Corporation as well as the OVAL Community for its assistance in contributing and reviewing the original document. The authors would also like to acknowledge Dave Waltermire of NIST for his contribution to the development of the original document. 6. IANA Considerations This memo includes no request to IANA. 7. Security Considerations While OVAL is just a set of data models and does not directly introduce security concerns, it does provide a mechanism by which to represent endpoint posture assessment information. This information could be extremely valuable to an attacker allowing them to learn about very sensitive information including, but, not limited to: security policies, systems on the network, criticality of systems, software and hardware inventory, patch levels, user accounts and much more. To address this concern, all endpoint posture assessment information should be protected while in transit and at rest. Furthermore, it should only be shared with parties that are authorized to receive it. Another possible security concern is due to the fact that content expressed as OVAL has the ability to impact how a security tool operates. For example, content may instruct a tool to collect certain information off a system or may be used to drive follow-up actions like remediation. As a result, it is important for security tools to ensure that they are obtaining OVAL content from a trusted source, that it has not been modified in transit, and that proper validation is performed in order to ensure it does not contain malicious data. 8. References 8.1. Normative References [RFC2119] Bradner, S., "Key words for use in RFCs to Indicate Requirement Levels", BCP 14, RFC 2119, DOI 10.17487/RFC2119, March 1997, . 8.2. Informative References Cokus, et al. Expires September 8, 2016 [Page 9] Internet-Draft OVAL Directives Model March 2016 [OVAL-WEBSITE] The MITRE Corporation, "The Open Vulnerability and Assessment Language", 2015, . Authors' Addresses Michael Cokus The MITRE Corporation 903 Enterprise Parkway, Suite 200 Hampton, VA 23666 USA Email: msc@mitre.org Daniel Haynes The MITRE Corporation 202 Burlington Road Bedford, MA 01730 USA Email: dhaynes@mitre.org David Rothenberg The MITRE Corporation 202 Burlington Road Bedford, MA 01730 USA Email: drothenberg@mitre.org Juan Gonzalez Department of Homeland Security 245 Murray Lane Washington, DC 20548 USA Email: juan.gonzalez@dhs.gov Cokus, et al. Expires September 8, 2016 [Page 10]