Oracle VM and OpenSCAP

With the release of Oracle VM Server 3.2.7 Oracle has started to ship oracle VM now also with OpenSCAP. OpenSCAP was already shipping with Oracle Linux and Oracle Solaris and is now also included in the Oracle VM server distributions. This is good news for all companies who do use Oracle VM and do have a need to tighten security.

"The Security Content Automation Protocol (SCAP) is a method for using specific standards to enable automated vulnerability management, measurement, and policy compliance evaluation (e.g., FISMA compliance). The National Vulnerability Database (NVD) is the U.S. government content repository for SCAP."

By adding the OpenSCAP implementation to Oracle VM server companies can now use the same tooling for checking against know vulnerabilities on your systems. This also makes it more easy to create a more enterprise wide approach to security checking and benchmark testing for all systems. You can now directly check your Oracle VM server installation against the SCAP messages containing CVE information.