The presentation by Richard Struse (US Department of Homeland Security) and Steve Christey (Mitre) of Risk Analysis and Measurement with CWRAF (PDF) at the IT Security Automation Conference in October 2011 illustrates how software security automation enumerations and protocols map to SAMM’s construction, verification and deployment security practices. The specifications highlighted in the presentation’s final slide are:

• Common Attack Pattern Enumeration and Classification (CAPEC)
• Common Weakness Enumeration (CWE)
• Common Weakness Risk Analysis Framework (CWRAF)
• Common Weakness Scoring System (CWSS)
• CWE Coverage Claims Representation (CCR)
• Security Content Automation Protocol (SCAP)
  • Common Vulnerabilities and Exposures (CVE)
  • Open Vulnerability Assessment Language (OVAL)

I have summarised the slide in the table below.

For further security registries, description languages and standardised processes see the Making Security Measurable website. Risk Analysis and Measurement with CWRAF is being presented at AppSec DC 2012 in April.