NIST, Red Hat unveil commenting system

System will allow vendors to report vulnerabilities, but problems could arise by allowing it to be publicly accessible, one analyst said.

Red Hat and the National Institute of Standards and Technology have agreed to create a commenting system for NIST’s National Vulnerabilities Database (NVD).

The system will give vendors a public forum to contribute information about vulnerabilities that could affect unforeseen targets.

Red Hat originally proposed the idea of using the database to NIST.

“We’ve been brainstorming this for a couple of years trying to figure out how to do it,” said Mark Cox, director of the security response team at Red Hat. Cox is one of the founders of the commenting system.

Red Hat has been using the system in a test program for the past few weeks and has submitted more than a hundred comments. One other company, Linux developer Mandriva, has added a comment about its software.

First of its kind
Cox said no other commenting system like NVD’s exists. The new system will enable users to manage vulnerabilities more efficiently, he said.

Without such a system, users sometimes must call companies directly to check whether certain vulnerabilities affect multiple programs.

“If it’s an Apache vulnerability, then how does that affect Red Hat?”Cox asked. Peter Mell, NVD program manager, said one of NIST’s primary concerns was to give vendors and security companies a chance to comment.

There was “no way for the security industry to put their 2 cents in with respect to what these vulnerabilities mean,” Mell said.

Buyer confusion
Some analysts say the new system could be beneficial for vendors in the long run but added that the fact that the system is publicly accessible could create some problems.

John Pescatore, vice president of Internet security at Gartner, said vendors could cause confusion if they use different terminology.

He said he is also concerned that people posing as vendors could put false information into the system.

“There’s a lot of slips between the cup and the lip,” he said.

Pescatore said NIST plans to create a mechanism to ensure that only authorized vendor representatives have access to the commenting system.

Featured

  • Defense
    The Pentagon (Photo by Ivan Cholakov / Shutterstock)

    DOD CIO hits pause on JEDI cloud acquisition

    Dana Deasy set cloud as his office's top priority. But when it comes to the JEDI request for proposal, he's directed staff to "pause" to compile a comprehensive review.

  • Cybersecurity
    By Gorodenkoff shutterstock ID 761940757

    Waging cyber war without a rulebook

    As the U.S. looks to go on the offense in the cyber domain, critical questions remain unanswered around who will take the lead and how clearly to draw the rules of engagement.

  • Government Innovation Awards
    Government Innovation Awards - https://governmentinnovationawards.com

    Deadline extended for Rising Star nominations

    You now have until July 18 to help us identify the early-career innovators and change agents in government IT.

Stay Connected

FCW Update

Sign up for our newsletter.

I agree to this site's Privacy Policy.