A Paradigm Shift in Vulnerability Identity: Why Vulnerability Databases Struggle
summary
Argues for an identity-first redesign that replaces prose-heavy CVE records with small, machine-verifiable assertions; two years of weekly design work shows there is no universal minimal field set (an attempted MVVE with ~5–7 fields fails). Points out data facts: 3 million CPEs in NVD with 58% missing versions, a CVE published roughly every 10 minutes, and CVSS scores sometimes revised five times over 13 months. Proposes assertion-level records, publisher-anchored identity contracts, provenance for each claim, and systems that accept continual updates and enable machine-usable deduplication.
AI-written summary · about
chapters (5)
- 0:00Vulnerability database challenges
- 4:41Vulnerability identity problems
- 19:24Nine principles for identity
- 46:08Applying identity principles
- 53:27Q&A
related talks
37mThe Vulnerability Identity Crisis
28mTowards a Minimum Viable Enumeration of Vulnerabilities
32mA Vulnerability Database Should Not Be About Vulnerabilities!
29mThe Quality Imperative for CVEs: The Need For Enhancing Vulnerability Reporting Standards
15mA vulnerability database should not be about vulnerabilities!
45mVulntology - A Methodology to Characterize Vulnerabilities While Providing A Granular & Intuitive...
30mThe Growing Crisis in CVE Data Quality
37mGoverning Global Vulnerabilities: Standards for Open Source Resilience