NC1701

SECURITYUPDATE
THE NAMING OF RISK
ACCURATE DEFINITION IS ESSENTIAL TO DEFEND AGAINST
KNOWN RISKS. TOD BEARDSLEY, RESEARCH DIRECTOR AT
RAPID7 EXPLAINS HOW THE INDUSTRY IS ORGANISING
AROUND CVE AND CNA
Common Vulnerabilities and
Exposures, or more simply CVE, is an
international project that is built to
catalogue and define cyber security
vulnerabilities, weaknesses and flaws in
systems, which in turn can provide potential
attackers with access to something that
should remain secure. Started in 1999 by
the MITRE Corporation, a U.S. based,
federally funded non-profit organisation,
CVE aims to provide a common set of
names and descriptions for software
vulnerabilities.
By referring to vulnerabilities according to a
widely-accepted, commonly-understood
naming scheme, security products can easily
interoperate, and security practitioners can
discuss, track and manage vulnerabilities in
an unambiguous way. Before CVE became
the common standard, the only thing
vendors and security researchers could use
to refer to vulnerabilities were proprietary
naming conventions sourced from a wide
variety of vendors and communities. These
were sometimes conflicting as people
referred to the Snort signature database,
Full-Disclosure mailing list posts,
PacketStorm exploits, X-Force IDs, Bugtraq
IDs - the list goes on and on.
Common names are especially useful when
multiple vulnerability management solutions
are in use in a single enterprise. Without
CVE it's extremely difficult to correlate
detection, mitigation, patches and other
corrective measures between vendor
solutions. Further complicating matters,
every enterprise would be forced to
implement their own custom translations
between solutions.
Occasionally vulnerabilities are published
using names that are puns or poetic, such as
Heartbleed, or as it is more accurately
known, CVE-2014-0160. This is rare
however, and the vast majority do not have
such memorable names. Other
vulnerabilities are composed of multiple,
distinct issues, sometimes simultaneously and
sometimes when further investigation reveals
many related, but distinct, underlying
software problems. Shellshock was one such
example: while the initial fix for the identified
vulnerability CVE-2014-6271 was initially
thought to be effective it was found to be
incomplete, and new variations of the
Shellshock vulnerability were discovered and
identified as CVE-2014-7169, CVE-2014-
6277, as well as some others. Shellshock's
ambiguous naming was exactly the sort of
problem that CVE solves. If vulnerabilities
are not assigned a unique name, users of
security solutions run the risk of working with
conflicting information about their own
exposure and risk.
CVE identifiers are not merely picked out of
the air by security researchers or security
product vendors. If they were, we'd be right
back in the thick of ambiguity. CVE identifiers
are issued by CVE Numbering Authorities
(CNAs) with the MITRE Corporation being
the primary editor and CNA for CVEs.
Currently there are 47 CNAs of which 38
are vendor-specific. Microsoft issues CVEs
for Microsoft products, Google for Google
and Android products, RedHat for RedHat
Linux issues and so on. A few are not
vendor-specific and can issue CNAs for
software vulnerabilities that affect vendors
who are not themselves CNAs. These
CNAs tend to be government funded
entities such as CERT/CC (the first Internetwide
computer emergency response team)
and Japan's JPCERT/CC, while others are
established security research organisations
including Rapid7 and Cisco's Talos Security
Intelligence and Research Group.
This federation of CNAs work to ensure
that vulnerabilities are named and
described in a consistent and logical way,
and more importantly help us to keep up
with the ever-quickening pace of
discovered and disclosed software
vulnerabilities.
It's critically important that security
practitioners have a clear understanding of
the vulnerabilities in their environments and
can distinguish between old and new
vulnerabilities, allowing them to make
informed decisions on threat management
strategies that best serve their
requirements. There are thousands of
vulnerabilities published as CVEs each
year, so the work that the CNAs do to
ensure clear and concise names and
definitions is an invaluable public service,
keeping the internet safe and secure. NC
16 NETWORKcomputing JANUARY/FEBRUARY 2017 @NCMagAndAwards
WWW.NETWORKCOMPUTING.CO.UK