Panel Discussion: It is a Tale as Old as Time…. a CNA, the NVD, and a CVE Consumer Walk Into a ...
summary
Panelists describe concrete actions and numbers: GitHub runs a curated Advisory DB (live since 2019) with humans reviewing every advisory and a public feedback repo; Google’s team converts CVEs into OSV.dev conversion and prototypes an ecosystem-specific identifier (ESI); NVD manages a CPE dictionary of 800,000+ entries, sees ~20% yearly CVE growth and email volume tripling in April 2020, and plans bulk CPE ingest plus a vulnerability ontology prototype to improve data quality and graceful degradation.
AI-written summary · about
chapters (15)
- 0:00Vulnerability identifier panel intro
- 2:31Purpose of vulnerability IDs
- 5:45Managing global vulnerability resources
- 9:40Public vulnerability data management
- 15:33Vulnerability database comparison
- 18:50Data quality in vulnerability ecosystems
- 22:01Vulnerability data longevity challenges
- 27:08Q&A on vulnerability trends
- 30:05Software ID challenges
- 33:15NVD email volume increase
- 34:01Vulnerability standards governance
- 40:27Cross-border vulnerability challenges
- 43:44Evolving vulnerability standards
- 47:17Democratizing vulnerability governance
- 50:47Closing remarks
related talks
51mCNA Birds of a Feather: Open Forum with Certified Numbering Authorities
30mThe National Vulnerability Database (NVD) – Where It Is and Where It’s Going
01h 04mOpen Discussion - International Challenges with CVD, CNA, and CVE
41mNIST’s National Vulnerability Database Update and the Vulnerability Enrichment Ecosystem
29mThe Quality Imperative for CVEs: The Need For Enhancing Vulnerability Reporting Standards
01h 00mThe CVE Program Quality Era: Strengthening Trust and Impact In Global Vulnerability Data
24mSecurity Advisories and Vulnerability Prioritization in the Wild
56mCISA’s North Star Vision for the CVE Program