Vulnrichment: Year One
summary
CISA publishes machine-readable vulnerability enrichment back into the CVE corpus via CVE ADP, and mirrors records and public disputes on GitHub Issues so omissions get fixed openly; enrichment supplies SSVC and KEV flags and fills missing CVSS/CWE but explicitly defers to the originating CNA data. A live experiment with CPE experiment Apr–Dec 2024 proved costly and is paused. Backlog clears over the year, triage/enrichment scale up, issues average 2.1 comments and ~6.5 days open, and some fixes happen within hours.
AI-written summary · about
chapters (13)
- 0:00Vulnrichment Year One intro
- 1:45CISA’s vulnerability mission
- 4:53Operational vulnerability analysis
- 7:21Design goals for Vulnrichment
- 9:50Accuracy and transparency
- 12:39Vulnrichment process flow
- 15:35Public GitHub transparency
- 17:45Community feedback lessons
- 20:17CPE enrichment challenges
- 23:26Refocusing core competencies
- 24:50Non-authoritative future plans
- 26:40Community experimentation
- 27:22Q&A
related talks
35mVulnrichment Playground
41mNIST’s National Vulnerability Database Update and the Vulnerability Enrichment Ecosystem
30mThe Growing Crisis in CVE Data Quality
01h 00mThe CVE Program Quality Era: Strengthening Trust and Impact In Global Vulnerability Data
58mWhy Can't We All Just Get Along? Bridging the Gap in Vulnerability Prioritization Standards
52mThe Evolution of CVEs, Vulnerability Management, and Hybrid Architectures
32mStepping up the ENISA's role in Support of EU Vulnerability Services
51mPanel Discussion: It is a Tale as Old as Time…. a CNA, the NVD, and a CVE Consumer Walk Into a ...