再保险:CVE的用例

5。描述:软件提供商想脆弱性信息组织成类创建软件开发工具,检查常见的错误发生在软件开发生命周期。隐含要求:历史的标识符列表发布有足够的信息可以分类成类似的漏洞——Kent Landfield + 1.817.637.8026类:< owner-cve-editorial-board-list@lists.mitre.org <mailto: owner-cve-editorial-board-list@lists.mitre.org> >代表“展位,哈罗德(美联储)”mailto: harold.booth@nist.gov> >日期:周三,2016年4月13日下午2点到:“cve-editorial-board-list@lists.mitre.org <mailto: cve-editorial-board-list@lists.mitre.org> " < cve-editorial-board-list@lists.mitre.org <mailto: cve-editorial-board-list@lists.mitre.org> >主题:CVE用例在过去的板叫有一个用例的讨论,我们一致认为这是董事会的作业。我想这个线程开始收集和识别的各种用例周围存在一个漏洞的使用标识符。我也摇摆了识别这些用例创建的一些需求。我试图捕获用例,我听到别人的声音除了那些我熟悉,希望他们能反应,更新和改正我走失的地方。我发现在[1]的一些信息有用的在开发这个列表。我不确定这是足够的,或者为这个活动的细节,但想从一些相对简单,从那里开始。在缺乏任何形式的术语表:软件提供者:创造的人,分发,主机,或维护产品为最终用户最终用户:可以包含漏洞的人是产品的最终用户可以包含漏洞安全研究员:人调查的安全产品,如发现漏洞脆弱性协调员:人作为协调员在脆弱性披露生命周期每个用例描述的格式:<演员(s) >想<执行一些操作/活动>为了满足一些客观/需要> <。在没有特定的顺序:1。描述:软件提供商、安全研究员和脆弱性协调员希望能够识别整个发现漏洞,修复,和咨询发布生命周期以跟踪和分享信息在不同的组。隐含的要求:在整个过程中使用相同的标识符或使用不同的标识符时,需要有一种机制来将他们联系起来。 2. Description: End users would like to know what vulnerabilities exist in order to track through the assessment, prioritization, and remediation lifecycle for any vulnerabilities that exist within their environment Implied Requirements: All vulnerabilities are identified and listed to the end user Enough actionable information is associated with the identifier to allow an end user to perform necessary activities 3. Description: End users would like to have a common identifier for vulnerabilities in order refer to vulnerabilities using the same methodology while using different/multiple tools as part of their vulnerability management lifecycle. Implied Requirements: Interoperable identifier used by a broad cross-section of tools/information providers (absent that, some methodology to relate vulnerabilities will be needed) 4. Description: Information providers would like to provide information about vulnerabilities in order to assist users throughout the vulnerability management lifecycle. Implied Requirements: All vulnerabilities have an associated identifier and are listed with enough information to identify the issue [1]https://insights.sei.cmu.edu/cert/2014/12/vulnerability-coordination-and-concurrency-modeling.html