Security System Analyzer

Security System Analyzer is a tool designed to check your system for the latest security updates.

Open Vulnerability and Assessment Language (OVAL) is an international, information security, community standard to promote open and publicly available security content, and to standardize the transfer of this information across the entire spectrum of security tools and services. OVAL includes a language used to encode system details, and an assortment of content repositories held throughout the community.

The language standardizes the three main steps of the assessment process: representing configuration information of systems for testing; analyzing the system for the presence of the specified machine state (vulnerability,configuration, patch state, etc.); and reporting the results of this assessment.

After using it during my security assessments, i was completely happy with results. It helps me out to find out new attack vectors and undetected vulnerabilities reported by the usual automated scanners.

The command line release (by mitre.org) is sometimes hard to manage (copying new xml files, editing .html reports), so we decided to write a GUI to make it simple to use and understand and then free the security testers community to take advantage of it.

Here are some key features of "Security System Analyzer":

￭ OVAL-compatible product ￭ SCAP (Security Content Automation Protocol) ￭ Perform a deep inventory audit on installed softwares and applications ￭ Scan and map vulnerabilities using non-intrusive techniques based on schemas ￭ Detect and identify missed patches and hotfixes ￭ Define a patch management deployment strategy using CVSS scores

Requirements:

￭ Internet Explorer 5.1 or higher / Firefox / Safari (needed to read HTML report)