Managing vulnerabilities in networked systems

TLDR

Many organizations implement cyber security measures yet fail to address known software vulnerabilities that can be exploited to bypass other defenses. The CVE initiative aims to prevent security disasters by establishing a common naming practice for software vulnerabilities, turning vulnerability management into a strategic asset. CVE coordinates international, community-based efforts to rapidly identify and fix software vulnerabilities, integrating the resulting common names into security tools, services, and vendor fix sites. As vendors respond to user requests for CVE‑compatible fix sites, enterprise security will gradually encompass the full cycle of finding, analyzing, and fixing vulnerabilities.

Abstract

Most organizations recognize the importance of cyber security and are implementing various forms of protection. However, many are failing to find and fix known security problems in the software packages they use as the building blocks of their networks and systems, a vulnerability that a hacker can exploit to bypass all other efforts to secure the enterprise. The Common Vulnerabilities and Exposures (CVE) initiative seeks to avoid such disasters and transform this area from a liability to a key asset in the fight to build and maintain secure systems. Coordinating international, community-based efforts from industry, government and academia, CVE strives to find and fix software product vulnerabilities more rapidly, predictably, and efficiently. The initiative seeks the adoption of a common naming practice for describing software vulnerabilities. Once adopted, these names will be included within security tools and services and on the fix sites of commercial and open source software package providers. As vendors respond to more users requests for CVE-compatible fix sites, securing the enterprise will gradually include the complete cycle of finding, analyzing, and fixing vulnerabilities.