Saturday, January 5, 2019

Configuration Baselines and Assessment Tools

​TOOL ​DESCRIPTION NSA​ ​STIG ​USGCB ​CIS ​IAVM

 ​Windows 7 ​Windows Server 2008/2008R2 ​RHEL ​CentOS ​Fedora Linux ​OpenSuSE ​Debian ​Ubuntu ​Apple OS X
​ACAS (Nessus) ​ ​ ​x ​ ​ ​x ​x x​
​		 ​x ​ ​ ​ ​ ​ ​
OpenSCAP ​​​ ​ ​ ​ ​ ​ ​ ​ ​x ​x ​ ​ ​ ​ ​
​SCAP Compliance Checker (SCC) ​The Security Content Automation Protocol (SCAP) Compliance Checker (SCC) is a SCAP 1.0 Validated Scanner, with support for SCAP versions 1.1 and 1.2, and an Open Vulnerability Assessment Language (OVAL) adopter, capable of performing compliance verification using SCAP content, and authenticated vulnerability scanning using OVAL content.  ​ ​x ​ ​ ​ ​x ​x ​x ​ ​ ​ ​ ​ ​
STONIX​ https://github.com/CSD-Public/stonix ​x ​x ​x ​x ​ ​ ​x ​v6, v7 ​v7 ​v20, v21 ​12.2 ​(stable) ​14.04 ​v10.9, v10.10
​OpenVAS ​Open source vulnerability scanner and manager that was forked from Nessus in 2005. Able to detect more than 35,000 vulnerabilities. ​ ​ ​ ​ ​ ​ ​ ​ ​ ​ ​ ​ ​ ​
Configuration Baselines:
Checklists and Assessment Tools
GSA and OMB required NIST validation of configuration and vulnerability scanners. The list of NIST validated configuration and vulnerability scanners is here:  ​​https://nvd.nist.gov/SCAP-Validated-Tools.
Source Code Inspection:
Web Application:
Forensics:
  • Backtrack
  • ​Dshell​. An extensible network forensic analysis framework. Enables rapid development of plugins to support the dissection of network packet captures. ​
Reports:
Posted by at

No comments:

Post a Comment

Subscribe to: Post Comments (Atom)