NIST, Red Hat unveil commenting system

Red Hat and the National Institute of Standards and Technology have agreed to create a commenting system for NIST’s National Vulnerabilities Database (NVD).

The system will give vendors a public forum to contribute information about vulnerabilities that could affect unforeseen targets.

Red Hat originally proposed the idea of using the database to NIST.

“We’ve been brainstorming this for a couple of years trying to figure out how to do it,” said Mark Cox, director of the security response team at Red Hat. Cox is one of the founders of the commenting system.

Red Hat has been using the system in a test program for the past few weeks and has submitted more than a hundred comments. One other company, Linux developer Mandriva, has added a comment about its software.

First of its kind
Cox said no other commenting system like NVD’s exists. The new system will enable users to manage vulnerabilities more efficiently, he said.

Without such a system, users sometimes must call companies directly to check whether certain vulnerabilities affect multiple programs.

“If it’s an Apache vulnerability, then how does that affect Red Hat?”Cox asked. Peter Mell, NVD program manager, said one of NIST’s primary concerns was to give vendors and security companies a chance to comment.

There was “no way for the security industry to put their 2 cents in with respect to what these vulnerabilities mean,” Mell said.

Buyer confusion
Some analysts say the new system could be beneficial for vendors in the long run but added that the fact that the system is publicly accessible could create some problems.

John Pescatore, vice president of Internet security at Gartner, said vendors could cause confusion if they use different terminology.

He said he is also concerned that people posing as vendors could put false information into the system.

“There’s a lot of slips between the cup and the lip,” he said.

Pescatore said NIST plans to create a mechanism to ensure that only authorized vendor representatives have access to the commenting system.