MITRE Celebrates 10 Years of OVAL

FOR IMMEDIATE RELEASE:

BEDFORD, Mass., February 12, 2013 — The MITRE Corporation's Open Vulnerability and Assessment Language (OVAL®), an international community effort to standardize and promote publicly available information security content, recently marked its tenth anniversary. During the last decade, OVAL has generated widespread industry adoption and numerous information security standardization efforts and significant government initiatives have leveraged and relied on its expertise.

OVAL provides an open format for machine-readable checks to detect software vulnerabilities, misconfigurations, programs and patches on computer systems. Having an open format enables interoperability and transparency between tools and facilitates collaboration and information sharing among the information security community.

OVAL is a collaborative effort between MITRE and the OVAL community, which is comprised of a broad spectrum of industry, academia and government representatives.

"Community involvement is critical to the success of OVAL," said Gary Gagnon, senior vice president and chief security officer at MITRE. "The collaborative spirit of the information security community allows OVAL to reflect the insights and combined expertise of the broadest possible range of system and security professionals."

With community support, OVAL has matured significantly in the last decade by:

• Expanding from a single schema for writing definitions into three schemas: a System Characteristics Schema for representing how a system is configured; a Definition Schema for expressing a specific system configuration; and a Results Schema for presenting the results of an assessment.
• Broadening the scope of the OVAL Repository and evolving it into the central location for publicly available OVAL content. The Repository now has more than 14,000 definitions largely developed and contributed by the community.
• Introducing the OVAL Interpreter, an open-source reference implementation that collects system configuration information, evaluates it against OVAL Definitions and presents results. The Interpreter has been downloaded more than 30,000 times since it was posted on SourceForge.net in 2008.
• Increasing industry awareness and adoption. Twenty products from 15 organizations are official OVAL adopters, and an additional 36 products from 28 organizations have signed declarations to adopt OVAL.

"During the past 10 years, the community has truly made OVAL what it is today," said Jon Baker, an associate department head at MITRE. "We look forward to continued collaboration with the community to transfer OVAL to an appropriate formal standards body, enabling it to achieve the next level of maturity and use."

OVAL was initially sponsored by the General Services Administration's Federal Computer Incident Response Capability. The Office of Cybersecurity and Communications at the U.S. Department of Homeland Security is the current sponsor.

Free for research, development and commercial use, OVAL is maintained by MITRE on its website, https://oval.mitre.org.

About The MITRE Corporation

The MITRE Corporation is a not-for-profit organization that provides systems engineering, research and development, and information technology support to the government. It operates federally funded research and development centers for the Department of Defense, the Federal Aviation Administration, the Internal Revenue Service and Department of Veterans Affairs, the Department of Homeland Security, the Administrative Office of the U.S. Courts, and the Centers for Medicare & Medicaid Services, with principal locations in Bedford, Mass., and McLean, Va. To learn more, visit www.mitre.org.

Solutions That Make a Difference.®
Copyright © 1997-2013, The MITRE Corporation. All rights reserved.
MITRE is a registered trademark of The MITRE Corporation.
Material on this site may be copied and distributed with permission only.

Privacy Policy | Contact Us