The nonprofit Industry Consortium for Advancement of Security on the Internet (ICASI) this week announced the release of a framework designed to standardise security vulnerability reporting.
The free Common Vulnerability Reporting Framework (CVRF) was created to provide security practitioners and vendors with a common method for the creation, dissemination and consumption of security vulnerability data, said Mike Schiffman, chairman of ICASI's CVRF working group and a computer security researcher at Cisco.
Historically, no accepted standard for security vulnerability reporting has existed, Schiffman said.
Because each vendor uses its own format, security practitioners must manually parse through many ad-hoc bug reports and bulletins to find information that is applicable to their environment, a task that is time consuming and imperfect.
The CVRF assimilates vulnerability reporting into a machine-readable XML format, which allows security professionals to automatically process the bug reports for tasks such as priority escalation, trouble ticketing, patch management and cataloging, Schiffman said.
ICASI has encouraged all vendors that publish security documentation to employ the CVRF.
Specifically, members of the working group – including Cisco, Intel, IBM, Juniper Networks, Microsoft, Nokia, Oracle and Red Hat – are expected to begin using the framework over the next several months. Vendors will still supply vulnerability reports and bulletins through their websites.
“CVRF represents a true milestone in industry efforts to raise and broaden awareness of security vulnerabilities,” Linda Betz, president of ICASI and director of IT policy and information security at IBM, said in a statement.
“The producers of vulnerability reports will benefit from faster and more standardised reporting. End-users will be able to find, process and act upon relevant information more quickly and easily, with a higher level of confidence that the information is accurate and comprehensive."
