2 cissp ® Official Study Guide Eighth Edition

 Describing Vulnerabilities 
The security community depends upon a common set of standards to provide a common 
language for describing and evaluating vulnerabilities. NIST provides the community with 
the
Security Content Automation Protocol (SCAP)
to meet this need. SCAP provides 
this common framework for discussion and also facilitates the automation of interactions 
between different security systems. The components of SCAP include the following: 
■
Common Vulnerabilities and Exposures (CVE)
provides a naming system for describ-
ing security vulnerabilities. 
■
Common Vulnerability Scoring System (CVSS)
provides a standardized scoring system 
for describing the severity of security vulnerabilities. 
■
Common Configuration Enumeration (CCE)
provides a naming system for system 
configuration issues. 
■
Common Platform Enumeration (CPE)
provides a naming system for operating sys-
tems, applications, and devices. 
■
Extensible Configuration Checklist Description Format (XCCDF)
provides a language 
for specifying security checklists. 
■
Open Vulnerability and Assessment Language (OVAL)
provides a language for 
describing security testing procedures.
 Vulnerability Scans 
Vulnerability scans
automatically probe systems, applications, and networks, looking for 
weaknesses that may be exploited by an attacker. The scanning tools used in these tests 
provide quick, point-and-click tests that perform otherwise tedious tasks without requiring 
manual intervention. Most tools allow scheduled scanning on a recurring basis and provide 
reports that show differences between scans performed on different days, offering adminis-
trators a view into changes in their security risk environment. 

---

Performing Vulnerability Assessments 
669
There are four main categories of vulnerability scans: network discovery scans, network 
vulnerability scans, web application vulnerability scans, and database vulnerability scans. 
A wide variety of tools perform each of these types of scans. 
Remember that information security professionals aren’t the only ones 
with access to vulnerability testing tools. Attackers have access to the 
same tools used by the “good guys” and often run vulnerability tests 
against systems, applications, and networks prior to an intrusion attempt. 
These scans help attackers zero in on vulnerable systems and focus 
their attacks on systems where they will have the greatest likelihood of 
success.