Article Details

CVE fallout: The splintering of the standard vulnerability tracking system has begun. MITRE, EUVD, GCVE … WTF?. Comment The splintering of the global system for identifying and tracking security bugs in technology products has begun. Earlier this week, the widely used Common Vulnerabilities and Exposures (CVE) program faced doom as the US government discontinued funding for MITRE, the non-profit that operates the program. Uncle Sam U-turned at the very last minute, and promised another 11 months of cash to keep the program going. Meanwhile, the EU is rolling its own. The European Union Agency for Cybersecurity (ENISA) developed and maintains this alternative, which is known as the EUVD, or the European Union Vulnerability Database. The EU mandated its creation under the Network and Information Security 2 Directive, and ENISA announced it last June. The EUVD is similar to the US government's NVD, or National Vulnerability Database, in that it organizes disclosed bugs by their CVE-assigned unique ID, documents their impact, and links to advisories and patches. Interestingly, the Euro database also uses its own EUVD IDs to track security bugs as well as CVE-managed identifiers and GSD IDs, the latter of which are issued by the (what appears to be now-defunct) Global Security Database operated by the Cloud Security Alliance. Although the EUVD has been gestating for nearly a year, the uncertainty around the CVE program is set to push the European effort into the spotlight as a replacement, fallback, or alternative for CVE. ENISA is, we note, a partner of CVE; specifically, it's a CVE numbering authority. The EUVD "will hopefully gain more traction so that Europe can achieve self-sustainability in this domain as well," Marcus Söderblom, an infosec consultant at IT services giant Atea said this week. Ben Radcliff, senior director of cyber operations at infosec services provider Optiv, told The Register Thursday that the CVE funding fiasco revealed a serious flaw: Dependence on the largesse of a single, and now volatile, government. "Continued dependency on funding from CISA might put pressure on the organization to act and operate with less impartiality and political agnosticism," he added. "One of the key promises of EUVD is that it will be multi-nationally sponsored, ostensibly avoiding that pitfall." Or, it could present another pitfall: Separate bug tracking systems for the US and Europe. Like imperial versus metric, only worse. "While it's likely that there will be coordination between the US NVD and the EUVD such that records available in one database mirror those in the other, I do expect that regional regulatory governance will tend to favor one vulnerability database over another," Tim Mackey, head of software supply chain risk strategy at app security firm Black Duck, told The Register. The timing of the EU database's emergence "cannot be ignored as a coincidence," Flashpoint vulnerability analyst Brian Martin said on a Thursday webinar. "To me, it signals a global lack of trust in the US government's commitment to ensuring the continuity of CVE." Meanwhile, another "global" system for identifying and numbering security flaws, the Global CVE Allocation System or GCVE, sprang from CVE's almost-ashes. "But that essentially looks like it's one person on a GitHub project," Martin said. In addition to these two, there's also the new CVE Foundation, a non-profit formed to bring the CVE program under its auspices and eliminate a "single point of failure in the vulnerability management ecosystem." And, of course, MITRE will continue operating the CVE program per usual under its contract with the Feds — at least for the next 11 months. "There's no understanding or guarantee about what will happen after that point," Flashpoint vulnerability analyst Kecia Hoyt said on the webinar. "Maybe we can go enjoy our weekend at this point, but I don't want to be here having this conversation a year from now, and nothing's changed."  What's in a name? Having a standardized system for identifying vulnerabilities is extremely important, and helps keep everyone — companies, vulnerability researchers, developers, governments — on the same page. If someone says CVE-2017-5754, for example, there's no question they are talking about Intel's Meltdown, which did also show up in a handful of Arm CPU cores. This common language helps avoid what we currently have with cybercrime-groups, where various government agencies and private-sector threat intel firms all have their own naming conventions — is it Cozy Bear, Midnight Blizzard, or APT 29? And how loosely linked are Salt Typhoon, Famous Sparrow, and Earth Estries?  "I say Scattered Spider, you say Oktapus," Hoyt said, referring to two names for the collective of what's suspected to be young US and UK criminals known for their ransomware heists of Las Vegas casinos. "There's a whole lot of different terminology thrown around, and are we talking about the same thing? Does this report equal that report? That's really what CVE and did for the vulnerability space," she added. So now the question becomes: Will someone, a government, or a collective industry group, step in and provide a more permanent, universal system? Or will the entire vulnerability management system break off into a million pieces with companies, governments, and community-based orgs all naming and tracking vulnerabilities independently of each other. And if that's the case: Who to trust? "Having an independent government solution for this vulnerability catalog, versus a larger corporate or global organization, might seem like a good idea," Hoyt said, but added that "the former creates that single point of failure we're all experiencing."  However, putting a large company or even a coalition of tech giants in charge means "the possibility of bias and jeopardizing neutrality," she noted.