Common Vulnerability and Exposure (CVE) [21] - The
CVE provides a dictionary of the common vulnerabilities
with a reference to the set of the vulnerable products
(encoded in the CPE). It also offers vulnerability scoring
that reflects the severity of the vulnerability. We use the
CVE to retrieve the know vulnerabilities discovered in the
service or the platform under investigation.
Common Configuration Enumeration (CCE) [21] - The
CCE provides a structured and unique naming to systems’
configuration statements so that systems can communicate
and understand such configurations. We use the CCE in the
security controls implementation phase. Instead of
configuring security controls manually, the administrators
can assign values to security control templates’ parameters.
Our framework uses these configurations in managing the
selected security controls.