CNA Challenges From a National CERT Perspective
summary
CERT-In became CNA in Oct 2021 and operationalizes a Responsible Vulnerability Disclosure policy to assign CVE IDs for India-developed products, but CVE scope and root-cause attribution often require vendor input. Common specifics: vendors lack security programs, remediation is incomplete or bypassable, some vendors treat outreach as legal threats so CERT-In sometimes issues legal directions or uses snail mail outreach to engage unresponsive OEMs, and researchers set unrealistic public-deadlines or demand payment.
AI-written summary · about
chapters (7)
- 0:00Introduction
- 3:57CERT roles and responsibilities
- 8:11Motivation for CNA
- 13:05Vulnerability coordination challenges
- 18:47Vendor hesitancy and communication
- 20:56Policy feedback and media
- 22:02Key takeaways and future plans
related talks
51mCNA Birds of a Feather: Open Forum with Certified Numbering Authorities
45mNational CSIRT as a CVD Hub: Lessons from CERT.PL’s Vulnerability Coordination Cases
54mNo Action Required: CVE for Software as a Service
01h 00mCVE Records: The Cybersecurity Glow-Up You Didn’t Know You Needed
01h 04mOpen Discussion - International Challenges with CVD, CNA, and CVE
49mA National Initiative for Cybersecurity Advancement
56mCISA’s North Star Vision for the CVE Program
01h 00mThe CVE Program Quality Era: Strengthening Trust and Impact In Global Vulnerability Data