Add/Improve OVAL Applicability Mechanism

[DavidRies]

OVAL doesn’t clearly separate applicability criteria from configuration-driven criteria. Should we develop changes to OVAL that would enable authors to:

• Clearly separate applicability criteria, e.g. platform, platform version, product
• Place applicability criteria in inventory definitions
• Include CPE or SWID references in inventory definitions

Benefits

• It would be possible to evaluate SCAP content using previously collected inventory data (e.g. SWIDs)
• Collection and additional evaluation would only be necessary when:
  • The OS/Application version of a device is affected by the vulnerability or subject to the control
  • AND, the vulnerability or control is configuration-specific
• Allow for platform and/or application-specific content packaging

[DavidRies]

Just a note that we are working on this internally at Joval and it's gotten a bit large/complex and we aren't happy with our approach yet. So, we are reworking and hope to share an improved approach soon.

[DavidRies]

I've added a writeup summarizing our internal conversations and ideas for review and discussion:

https://github.com/scapcommunity/XCCDF/blob/master/working-documents/oval-applicability-problem-statement-ideas.md