|
|||||
 |
 |
||||
| CCE Website is in "Archive" status — read the announcement | |||||
CCE List — ArchiveIMPORTANT: The CCE List is now hosted at http://nvd.nist.gov/cce/index.cfm. Version — CCE 5 (Archive)The Common Configuration Enumeration (CCE) List is posted below. In Version 5 CCE-IDs are assigned according to "platform groups." The CCE List is available for download in two formats: the canonical Microsoft Excel spreadsheet format, and an alternative XML format. Spreadsheets are available in a single combined file and by individual platform group. XML is only available for the single combined file, containing CCE entries for all platform groups. Please note that the spreadsheets are the canonical format. In the case of any discrepancy between the XML and the spreadsheets, the spreadsheets should be preferred. Also, the format of the XML itself is version 0.2 of that encoding, and is subject to change. IMPORTANT: Activity on the CCE effort has been suspended, and the CCE Web site has been moved to "Archive" status. Read the complete message on the homepage. Release DetailsThe current release of CCE is 5.20130214 (CCE Version 5, updated on February 14, 2013). A ChangeLog is available that details the changes since the last release, 5.20120521. Total CCEs: 12,163
Comments or concerns: cce@mitre.org KeyEntries in the CCE List contain the following five attributes: CCE Identifier Number — Like CVE, CCE assigns identifier tags to each commonly recognized configuration issue. These identifiers are intended to be unique tags or keys, not descriptive names. By way of a loose analogy, CCE-IDs are like scientific names for animals, providing a precise identifier for a species that is agreed upon by the technical community but which may have little or no meaning in common language usage. Description — CCE entries contain a humanly understandable description of the configuration issue. This description is intended to describe the generic issue. In particular, it is not intended to make an assertion as to what particular configuration should or should not be made. For example, a valid CCE description might be "The minimum password length should be set appropriately". CCE makes no assertion whether the minimum password length should be 8, 10, or 14. It only describes the generic and non-qualified issue of minimum password length. Conceptual Parameters — CCE entries contain a list of conceptual parameters that would be needed to be specified in order to implement a CCE on a system. For example, for the CCE associated with "The startup type of the Telnet service should be correct" (for Windows) the conceptual parameters would be Automatic, Manual, and Disabled. CCE entries distinguish between such humanly understandable conceptual parameters and machine understandable parameters such as the specific registry key values that might be associated with the conceptual notions of "Automatic", "Manual", and "Disabled". Associated Technical Mechanisms — For any given configuration issue there may be more than one way to implement the desired result. For example, in Windows the issue of "The Autoplay feature should be set correctly for all drives" can be set either with a direct registry key edit or by way of a Group Policy Object if the system participates in an Active Directory domain. And in most forms of Unix and Linux, the issue of "The FTP service should be enabled or disabled as appropriate" can be achieved in multiple ways. One way to understand the distinction between the Description and its corresponding set of Technical Mechanisms is that the former describes a goal and the latter describes a set of ways to achieve that goal. References — Each CCE entry has a set of references from published configuration guidance documents such as the NSA Security Guides, the Center for Internet Security Benchmark, and DISA STIGS that point to the specific sections of the documents or tools in which the configuration issue is described in more detail. These references (1) provide a logical linkage to more detailed information, (2) validate the need for a CCE-ID for any given configuration issue, and (3) validate that the CCE entry is described at a level of abstraction that is used and accepted within the community. |
