|
|
||||
[日期Prev] [日期Next] [线Prev] [线程接下来] [日期Index] [线Index]
CVE董事会Meeting summary – 28 November 2018
- To: CVE Editorial Board Discussion <cve-editorial-board-list@mitre.org>
- Subject：CVE董事会会议摘要 - 2018年11月28日
- 从: Common Vulnerabilities & Exposures <cve@mitre.org>
- 日期: Tue, 11 Dec 2018 17:35:57 -0500
- Accept-language: en-US
- 身份验证重分：mitre.org;dkim = none（未签署消息）header.d = none; mitre.org;dmarc = none action = none header.from = mitre.org;
- Delivery-date: Tue Dec 11 18:34:39 2018
- 线-index: AdSRoeDOzc4s+m1GTXOUxLifnhHDvg==
- 线-topic：CVE董事会会议摘要 - 2018年11月28日
|
CVE董事会Meeting – 28 November 2018
Kent Landfield,McAfee
Art Manion,CERT/CC (Software Engineering Institute, Carnegie Mellon University)
Beverly Miller,Lenovo Group Ltd.
Scott Moore,IBM
丽莎·奥尔森（Lisa Olson），Microsoft
Kurt Seifried,Cloud Security Alliance
戴维·沃尔特里尔（David Waltermire），National Institute of Standards and Technology (NIST)
肯·威廉姆斯，Broadcom Inc.
Members of MITRE CVE Team in Attendance
乔·巴扎尔（Jo Bazar） Chris Coffin
Jonathan Evans 乔·塞恩 George Theall 其他与会者 Chris Johnson（nist）
Agenda 2:00 – 2:15: Introductions, action items from the last meeting
2:15 - 2:30：工作组
2：30 - 2:45：CNA更新
2：45 –3：15：CVE团队网络刮擦 -Chris Coffin
3:15 – 3:50: Open Discussion–Board
3:50 – 4:00: Action items, wrap-up
Review of Action Items from Board Meeting held 14 November 2018
工作组更新
CNA Updates
CVE团队网络刮擦
Open Discussion Items
Meeting Action Items
Board Decisions
未来的讨论主题
4) CNA Scope Issues The Board discussed thatCNA documentation around roles and responsibilities are needed, current documentation is not clear, CNA assign CVE within their scope. Scope may or may not cover CVE for their customers.
o
CNA Rules- The rules state CNAs must be responsive but does not provide a specific timeframe. The rules state if a CNA plans to assign a CVE for a vulnerability another vendor’s product, to the assigning CNA should contact the vendor. The vendor would then make a determination.
o
New Approach to CNAs and Roots- A given Root has a scope. A portion of the scope gets delegated to a CNA (i.e., product or area of research). If a portion of the scope is not delegated to a CNA, that scope stays with the Root. It is the Root’s responsibility to do the CVE assignment as the CNA of last resort.
o
Action Item– CNA Rules need to be updated to reflect this new approach.
5) Eliminate duplication CVE assignment discussion
o
The Board discussed that specifying CNA scope will help eliminate duplicate CVE assignments. Art explained that having open communication with other CNAs when making CVE assignments is critical; keeping this communication at the CNA level (not at Root/Primary level) will help with duplication.
o
Recommendation 1:过程建议需要添加到CNA培训中。
o
Recommendation 2:CNA rules need to be updated to minimize duplicate assignments.
o
Jonathan explained that duplication of CVE assignments occurs the most with DWF. 6）研究员CNA
o
The Board discussed researcher CNAs that have with ambiguous scopes. These CNAs have issued thousands of CVEs.
o
Recommendation 1:Avoid adding any new researcher CNAs until there are specific qualifications and guidelines for what qualifies as a researcher CNA. This includes defined scope rules yet to be discussed.
o
Recommendation 2:Make the scope naturally programmatic for researcher CNAs.
o
Recommendation 3:更改研究人员CNA的过程。谁负责协调ID分配？谁发行了CVE ID并填写信息？公司应该有一种更简单的方法要求CVE ID。
o
Recommendation 4:更好地定义研究人员CNA的角色和责任。
o
Recommendation 5:Need to address the researcher CNA ambiguous scope issue before onboarding additional researcher CNAs.
o
建议6：Explore the possibility of researchers participating in the CNA program without becoming CNAs.
o
建议7：Need a testing/certification program for CNAs to make sure they can adequately perform their role, especially researchers.
o
董事会同意探索有关研究人员CNA模棱两可范围问题的更好解决方案。
7)
有效地操作根CNA
o
Further discussion is needed regarding how we can operationalize Root CNAs more effectively.
o
需要关于MITER在操作根中的作用的其他讨论。
8)
Product Type Tagging/Categorization
o
随着CVE的生产编号的上升，将越来越需要查看整个CVE主列表的子集
o
Define a list of common product areas/domains to be used for categorizing CVE entries (e.g.., Medical devices, automotive, industrial, etc.)
o
标签/类别应附加到产品上，而不将其直接连接到CVE条目。
o
Product listings in CVE User Registry would be a potential location.
|
Attachment:CVE_Board_Meeting_28_November_2018.pdf
Description:CVE_Board_Meeting_28_November_2018.pdf
