A common language for security vulnerabilities - MITREs CVE

When hackers want to breach your systems, they typically look for well-known security flaws and bugs to exploit. In the past, vendors and hackers gave different names to the same vulnerabilities. One company might package a group of five vulnerabilities into a patch or service pack and call it by one name, while another vendor might call the same group by five separate names.

This confused IT decision makers who evaluated security products. It was difficult to compare scanning and intrusion detection tools because the vulnerabilities and exposures that they checked for had different names depending on the vendor's naming conventions. Fortunately, MITRE is changing that...

When one of MITRE's trusted data sources discovers a potential CVE entry, MITRE's CVE
editorial review board assigns it a candidate name and number. The CVE editorial review
board then reviews the candidate to make sure it is not already a candidate or a live
entry, and then votes whether to accept it as a CVE entry. MITRE's CVE editorial review
board consists of security experts from not only MITRE, but also the broader security
community, and includes experts from security consulting companies that are not aligned
with any vendor or product.

All security vendors should adopt MITRE's nomenclature. There is no fee for obtaining
the CVE list, and in fact you can download the entire list with a click from MITRE's site. With no other competing
nomenclature standards for common vulnerabilities and exposures, MITRE's list is the end
all and be all of common vulnerability and exposures for system and network security.

The CVE list makes it easier for security vendors to develop intrusion detection and
scanning tools. As more IT decision makers understand the meaning of CVE, products with
CVE-compatible names will likely receive a better reception on the market. According to
Marcus Ranum, CTO of NFR Security, a leading maker of intrusion detection products,
"It's critical to have all IDS products report detected vulnerabilities using a
common language. That way product 'A' doesn't tell you it's found a 'SYN flood attack'
while product 'B' tells you it's found a 'SYN denial of service'-- it saves time for the
end customer who needs to correlate information."

For network managers, products that contain CVE-compatible names make it easier to
handle day-to-day security issues. Security administrators can find out and tally how many
entries on the CVE list they have covered.

Some products currently containing CVE-compatible names include:

- NFR's
IDS
- PentaSECURITY's
Siren(IDS)
- Qualys'
QualysGuard
- ISS'
Internet Scanner
- Symantec's
Enterprise Security Manager
- BindView's
HackerShield
- PGP's CyberCop Scanner

Moving forward, one of the biggest challenges for MITRE will be quickly classifying new
CVE entries. According to MITRE, today there are 1,510 CVE names. With new vulnerabilities
being found every day, a speedy review and naming process is crucial.

MITRE's CVE development has been instrumental in untangling and verifying the wacky
jargon of security vulnerability names, and all eyes are on them to lead the way in
managing this complicated process.

Laura Taylor is the Chief
Technology Officer and founder of Relevant Technologies. Ms. Taylor has 17 years of
experience in IT operations with a focus in information security. She has worked as
Director of Information Security at Navisite and as CIO of Schafer Corp., a weapons
development contractor for the Department of Defense.