Standardised vulnerability reports to hit this year

By

Finding relevant details in security vulnerability reports can be a minefield.

The nonprofit Industry Consortium for Advancement of Security on the Internet (ICASI) this week announced the release of a framework designed to standardise security vulnerability reporting.

Standardised vulnerability reports to hit this year
hm.matheus, CC2.0

The free Common Vulnerability Reporting Framework (CVRF) was created to provide security practitioners and vendors with a common method for the creation, dissemination and consumption of security vulnerability data, said Mike Schiffman, chairman of ICASI's CVRF working group and a computer security researcher at  Cisco.

Historically, no accepted standard for security vulnerability reporting has existed, Schiffman said.

Because each vendor uses its own format, security practitioners must manually parse through many ad-hoc bug reports and bulletins to find information that is applicable to their environment, a task that is time consuming and imperfect.

The CVRF assimilates vulnerability reporting into a machine-readable XML format, which allows security professionals to automatically process the bug reports for tasks such as priority escalation, trouble ticketing, patch management and cataloging, Schiffman said.

ICASI has encouraged all vendors that publish security documentation to employ the CVRF.

Specifically, members of the working group – including Cisco, Intel, IBM, Juniper Networks, Microsoft, Nokia, Oracle and Red Hat – are expected to begin using the framework over the next several months. Vendors will still supply vulnerability reports and bulletins through their websites.

“CVRF represents a true milestone in industry efforts to raise and broaden awareness of security vulnerabilities,” Linda Betz, president of ICASI and director of IT policy and information security at IBM, said in a statement.

“The producers of vulnerability reports will benefit from faster and more standardised reporting. End-users will be able to find, process and act upon relevant information more quickly and easily, with a higher level of confidence that the information is accurate and comprehensive." 

This article originally appeared at scmagazineus.com

Got a news tip for our journalists? Share it with us anonymously here.
Copyright © SC Magazine, US edition
Tags:

Most Read Articles

Qantas facing 'significant' data theft after cyber attack

Qantas facing 'significant' data theft after cyber attack

Home Affairs officer accessed data on "friends and associates"

Home Affairs officer accessed data on "friends and associates"

International Criminal Court hit by cyber attack

International Criminal Court hit by cyber attack

Ex-student charged over Western Sydney University cyberattacks

Ex-student charged over Western Sydney University cyberattacks

Log In

  |  Forgot your password?