- Harold Booth, NIST (harold.booth@nist.gov)
- Larry W. Cashdollar, Akamai Technologies (larry@akamai.com)
- Kent Landfield, Intel (kent.b.landfield@intel.com)
- Art Manion, CERT/CC (amanion@cert.org)
- Brian Martin, OSF / OSVDB (jericho@attrition.org)
- Kurt Seifried, Red Hat (kseifried@redhat.com)
- David Waltermire, NIST (david.waltermire@nist.gov)
- Zachary Wikholm, Independent (kestrel@trylinux.us)
The Distributed Weakness Filing (DWF) Project provides a community based Open Source process oriented solution to getting CVE identifiers into the hands of people that need them. The DWF aims to work with security researchers and other “producers” of CVE IDs to assure the timely assignment of IDs. The project’s major focus is to become a CVE Numbering Authority (CNA) targeted primarily at the Open Source community.
The overall purpose of this Proof of Concept (PoC) is to test the validity of creating a new class of CNA. In the past CNAs have been, for the most part, an endpoint in the CVE ID issuance process. Authorized CNAs have been issued a block from the CVE ID pool they have then used to issue their own organizational IDs. This proposal is to create a Root CNA. The DWF Root CNA will be able to act as an existing CNA by issuing CVE IDs as requested. Additionally, the DWF Root CNA will be able to train and coordinate other organizations and people to create CNAs that live within the DWF namespace.
As this is a PoC, the plan is to take a “fail fast” approach. DWF will be experimenting where we believe good ideas should be put into an operational production environment to test the usefulness of the idea.
The following are the proposed specifics of the effort:
- The DWF Project will act as a CNA and ensure no conflicts between DWF and current CVE ID ranges. The DWF will start at a high range of numbers to avoid conflicts with CVE numbers.
- DWF Project will use the ID range CVE-YEAR-1000000 through CVE-YEAR-1999999.
- The DWF will assign CVE IDs to answer requests sent directly to the DWF by researchers, vendors and others.
- Any subordinate DWF authorized CNAs will only be allowed to exist under the DWF hierarchy and be restricted to the DWF authorized namespace (that is CVE-YEAR-1000000 through CVE-YEAR-1999999).
The DWF project will continue to work with MITRE and others to create guidelines and requirements for CVE requests, CNA creation, curation of CVEs and so forth. As mentioned earlier, the DWF will focus on Open Source software, security researchers and security vendors that find and report security vulnerabilities.
The DWF Project will continue to coordinate closely with MITRE and the CVE Editorial Board to ensure compatibility with existing and future CVE requirements and processes such as “what counts as a vulnerability”, SPLIT/MERGE and so forth.
DWF will work with MITRE and the CVE Editorial Board to create a base set of documentation of best practices that can assist with the development and processes of the Root CNA usage and deployment. While targeted towards DWF, the documentation can be used by others within the CVE management community.
The intent of this POC is to determine the effectiveness of new techniques, ideas and a new hierarchy-based model for CNA creation and CVE issuance. If successful, this approach will allow for other Root CNA authorities to be set up. Future CNAs could be assigned based on technology sectors or national boundaries thus allowing expansion and expertise in areas of vulnerability identification not currently possible in the existing CVE management approach/scheme.