NIST, Red Hat unveil commenting system

System will allow vendors to report vulnerabilities, but problems could arise by allowing it to be publicly accessible, one analyst said.

Red Hat and the National Institute of Standards and Technology have agreed to create a commenting system for NIST’s National Vulnerabilities Database (NVD).

The system will give vendors a public forum to contribute information about vulnerabilities that could affect unforeseen targets.

Red Hat originally proposed the idea of using the database to NIST.

“We’ve been brainstorming this for a couple of years trying to figure out how to do it,” said Mark Cox, director of the security response team at Red Hat. Cox is one of the founders of the commenting system.

Red Hat has been using the system in a test program for the past few weeks and has submitted more than a hundred comments. One other company, Linux developer Mandriva, has added a comment about its software.

First of its kind
Cox said no other commenting system like NVD’s exists. The new system will enable users to manage vulnerabilities more efficiently, he said.

Without such a system, users sometimes must call companies directly to check whether certain vulnerabilities affect multiple programs.

“If it’s an Apache vulnerability, then how does that affect Red Hat?”Cox asked. Peter Mell, NVD program manager, said one of NIST’s primary concerns was to give vendors and security companies a chance to comment.

There was “no way for the security industry to put their 2 cents in with respect to what these vulnerabilities mean,” Mell said.

Buyer confusion
Some analysts say the new system could be beneficial for vendors in the long run but added that the fact that the system is publicly accessible could create some problems.

John Pescatore, vice president of Internet security at Gartner, said vendors could cause confusion if they use different terminology.

He said he is also concerned that people posing as vendors could put false information into the system.

“There’s a lot of slips between the cup and the lip,” he said.

Pescatore said NIST plans to create a mechanism to ensure that only authorized vendor representatives have access to the commenting system.

FCW in Print

In the latest issue: Looking back on three decades of big stories in federal IT.

Featured

  • FCW @ 30 GPS

    FCW @ 30

    Since 1996, FCW has covered it all -- the major contracts, the disruptive technologies, the picayune scandals and the many, many people who make federal IT function. Here's a look back at six of the most significant stories.

  • Shutterstock image.

    A 'minibus' appropriations package could be in the cards

    A short-term funding bill is expected by Sept. 30 to keep the federal government operating through early December, but after that the options get more complicated.

  • Defense Secretary Ash Carter speaks at the TechCrunch Disrupt conference in San Francisco

    DOD launches new tech hub in Austin

    The DOD is opening a new Defense Innovation Unit Experimental office in Austin, Texas, while Congress debates legislation that could defund DIUx.

  • Shutterstock image.

    Merged IT modernization bill punts on funding

    A House panel approved a new IT modernization bill that appears poised to pass, but key funding questions are left for appropriators.

  • General Frost

    Army wants cyber capability everywhere

    The Army's cyber director said cyber, electronic warfare and information operations must be integrated into warfighters' doctrine and training.

  • Rising Star 2013

    Meet the 2016 Rising Stars

    FCW honors 30 early-career leaders in federal IT.

Reader comments

Please post your comments here. Comments are moderated, so they may not appear immediately after submitting. We will not post comments that we consider abusive or off-topic.

Please type the letters/numbers you see above

More from 1105 Public Sector Media Group