Updated CVE Roadmap Follows Threats to Funding
The U.S. cyber defense agency is unveiling a new vision for its globally-adopted vulnerability tracking system but security analysts warn that funding threats and turmoil inside the federal agency could derail any reforms before they take hold.
See Also: Post-Quantum Cryptography – A Fundamental Pillar in the Future of Cybersecurity [ES]
The Cybersecurity and Infrastructure Security Agency’s new vision for the Common Vulnerabilities and Exposures program marks what the agency calls a shift from the program’s “growth era” to its “quality era.” The strategy outlines plans to bolster trust, responsiveness and data quality by expanding community partnerships, collaborating with industry and international governments to standardize vulnerability data, scaling enrichment through federated mechanisms and growing the authorized data publisher capability.
The announcement comes only months after the program nearly shuttered following a Trump administration decision to yank funding, a decision reversed just hours before taking effect (see: Cybersecurity Alarms Sound Over Loss of CVE Program Funding).
CISA itself is reeling from steep budget cuts and the loss of roughly one-third of its staff, raising doubts among experts about the agency’s ability to deliver on the its ambitious roadmap.
The CVE program dates to 1999. It standardizes how network defenders, security officials and critical infrastructure operators catalog and reference cybersecurity flaws. Funded by the Department of Homeland Security and maintained by the Mitre Corporation, the program has shaped how organizations mitigate known vulnerabilities.
Its ubiquity hasn’t come without criticism, encompassing complaints about its reliability to worries that the sustained, annual growth in the number of CVEs makes it harder for cyber defenders to accurately assess their risk. The program’s sole reliance on DHS for funding has been another concern, one thrown into the spotlight by its near brush with mortality in April. Other recent controversies include board infighting over proposed oversight reforms and recurring complaints from researchers about delays and inconsistent vulnerability data.
“Actions speak louder than words, so the next steps from CISA and the CVE Foundation will be crucial to achieve success,” said Brandon Potter, chief technology officer for the security firm ProCircular. “Unfortunately, it’s more about the uncertainty of what is next that is having the broadest impact.”
Throughout the program’s initial “growth era,” CISA said it the program was defined by the recruitment of a global network of more than 460 CVE numbering authorities. That allowed the cybersecurity community to identify, define and catalog hundreds of thousands of vulnerabilities.
The program’s “quality era” will include improvements such as more complete records that include CVSS scores and references to the Common Weakness And Enumeration catalog of vulnerability exploitation methods, CISA said. The agency will prioritize automation and online services for numbering authorities and ensure that that the full sweep of the cybersecurity community is represented in the advisory board, CISA also pledged.
The strategy asserts the program’s value traces to its government backing. Privatizing CVE “would dilute its value as a public good,” CISA said. Private sector ownership of the program would run into conflicts of interest from sponsors torn between the imperative of disclosing vulnerabilities and hushing them up “to avoid potential economic or reputational harm.”
The strategy nonetheless says CISA is evaluating “potential mechanisms for diversified funding,” promising updates at a later date.
Trey Ford, CISO for bug bounty platform Bugcrowd, told Information Security Media Group that private industry is particularly “hungry to better understand the roadmap around investment and timeline to market” for strengthening numbering authority infrastructure.
“There is so much opportunity to improve the CVE program,” Ford said. “We want to see these investments align with the private sector folks doing the hard work processing and validating vulnerability submissions, and ultimately improving the quality of CVE records going forward.”
CISA is “seizing the opportunity to modernize the CVE Program” and “solidifying it as the cornerstone of global cybersecurity defense,” said Nick Andersen, CISA’s new executive assistant director for cybersecurity. Andersen said in a statement that the agency seeks to “enhance the quality of vulnerability data and global cybersecurity resilience” through a newly-modernized framework that includes community feedback and engagement with global partners.
Analysts told ISMG that while CISA should still play a lead in the program, it must follow through with pledges of extensive collaboration with private sector organizations and set clear expectations.