Vulntology - A Methodology to Characterize Vulnerabilities While Providing A Granular & Intuitive...
Talkat Global Security Vulnerability Summit @ Open Source Summit North America 2022 · on Thursday, 2022-06-23· at 14:55· Brazos (Level 2), JW Marriott Austin, 110 E 2nd Street Austin, TX 78701·
summary
A formal ontology maps vulnerabilities into concrete objects—vulnerability identifiers, scenario object, product, barrier, action and impact—so free text CVE descriptions become machine-readable. A JSON schema exists and an alpha web UI produces importable/exportable JSON; examples include a buffer overread split into two scenarios and a stored XSS case that demonstrates programmatic description generation. The model supports CPE/CVE and other IDs, aims to reduce data loss (missing attack theater) and enable downstream automation.
AI-written summary · about
chapters (14)
- 0:00Intro
- 1:12Light Overview
- 7:50Problems: Language Barriers
- 10:22Structure Changes
- 13:44Vulnerability Object
- 15:33Vulnerability Identifier Object
- 17:17Scenario Object
- 19:20Product Object
- 20:48Barrier Object
- 21:33Action Object
- 23:44Impact Object
- 26:24Single Scenario
- 30:17Multiple Scenarios
- 37:31Recap
related talks
37mThe Vulnerability Identity Crisis
28mTowards a Minimum Viable Enumeration of Vulnerabilities
23mHitchhikers' Guide to the Vulniverse
37mPrioritizing Vulnerability Response with a Stakeholder Specific Vulnerability Categorization
57mA Paradigm Shift in Vulnerability Identity: Why Vulnerability Databases Struggle
25mBOF: Vulnerability Data Consumers
36mAll you wanted to know about sw vulnerabilities…but were too busy to look into
31mValidating Vulnerability Analysis with Statistical Analysis of Metadata