Analyze Desktop Security with SSA

Earlier, there was no common standard for detecting vulnerabilities on a
Windows desktop. Things are however changing. There is a standard called OVAL,
which is aimed at promoting open security content. The Open Vulnerability and
Assessment Language (OVAL) aims to regulate transfer of information across all
security related services and applications. It has standardized the
configuration of systems for testing, assessment and reporting.

In OVAL, technical details of how to detect a particular vulnerability are publically shared and its definition database is built by collaboration amongst
vendors, security companies and consultants. Moreover, OVAL allows sharing of
technical details regarding identification of the presence or absence of
vulnerabilities on a computer system. Earlier OVAL could be only used through a
command line tool from 'mitre.org,' but now the process has been eased with
System Security Analyzer (SSA). It has a simple GUI and also provides easy to
understand reports. Currently, the software runs on Windows Vista, XP and 2000.

How to use

Installation of the System Security Analyzer is simple. After installation,
when it is launched for the first time, it will automatically update its
definition database. Once database is updated, go to the 'Configuration' tab on
the Menu bar to open its configuration window. Choose the OVAL definition as per
the operating system you are using. By default four definitions are available
for Windows Vista, XP and 2000, alongwith a default OVAL definition. Now, click
on the 'scan' button to start scanning for vulnerabilities. Once the scan is
finished, SSA will show you all the detected vulnerabilities along with its OVAL
ID as well as their CVE number. To see more details from the report menu, click
on 'View HTML Report' tab. In this report you can see all the detected
vulnerabilities with a brief description about them. To find further details
about the vulnerability and how to fix it, click on the 'vulnerability and CVE
ID' link, which takes you to its online database, where you find vulnerabilities
analysis from various security agencies and the vendors.

Reports generated by SSA provide a brief description of detected vulnerabilities and online links to get a detailed description