6 ms·

Weren't there major problems with the current CVE implementation, especially with the waves of script kiddies and AI tools spamming the database and the fact th

• czk 2y ago
  and then a random 9.8 critical comes that affects some software you have in a way that makes it a 0 in your environment but it doesn't matter cause the cve tanks your organizational Security Score (tm) by 10 arbitrary points and management is wondering when you'll secure the company again because the Security Score is their only tangible deliverable to measure success
  • deleted 2y ago
    [deleted]
  • idiotsecant 2y ago
    I feel that. So tired of management being completely uninterested in actual, actionable security holes but getting wildly spun up because they saw a notice with a big scary number that has absolutely no relevance in our architecture.
  • deleted 2y ago
    [deleted]
  • icameron 2y ago
    Yeah like when we bundled in a .js library for client side date processing that has a CVE affecting node.js servers with high score. Our auditors don’t care they tag the whole app as high risk. It doesn’t even run on the server!
    • czk 2y ago
      the auditors that sign off on your security to meet your clients requirements usually know way less about your security posture than your clients do its all just surface-level box-checking. most companies required to get 'penetration tests' just get an overpriced Nessus scan sold as a pentest and that meets their reqs.
      • JohnMakin 2y ago
        while this is true it in no way diminishes the value that orgs like cve provide
    • jeroenhd 2y ago
      Incompetent auditors don't detract from the classification system, though. If we removed every data point auditors misinterpret or don't care to understand, we may as well remove all metrics.
  • giantg2 2y ago
    Most tracking tools have exception processes. But yeah, security as a product family instead of a simple score seems to be a foreign concept at most companies.
  • maronato 2y ago
    Don’t let the perfect be the enemy of good. It is(was?) a very useful and important system. Trump must be receiving a lot of emails from companies wanting to fill the void, and I bet the Trumpiest of them all is going to be awarded a contract worth 10x the budget CVE had, and do a much worse job.
  • horacemorace 2y ago
    It’s Way Better than what we had before: software vendors making even arbitrarier decisions about how to classify them. There are far too many bad actors for us to operate as an industry with no yardstick.
    • ngneer 2y ago
      I disagree that it is Way Better than before. A judgement call is worth more than a team wasting effort chasing irrelevant pseudo-vulnerabilities being reported as vulnerabilities. A broken yardstick is worse than no yardstick.
      • grumbelbart2 2y ago
        But that's an issue organizations bring upon themselves, by defining semi-arbitrary KPIs that are used without proper interpretation. It's not directly caused by CVEs or assigned scores. It's like blaming git that it count lines in diffs, because your company created a KPI that measures developer's based on LOC changes.
        • ngneer 2y ago
          Fair point. I was not blaming CVE for the situation, simply bemoaning the situation.
  • ngneer 2y ago
    Spot on. Vulnerability scanners that make up an organizational Security Score (TM) tend to operate at the wrong level of abstraction, flagging some library somewhere that never runs and has nothing to do with your production flow or architecture, or some test keys with zero security impact. Go explain that to management, because obviously the security tools are right and you are wrong. This sad state of affairs is unfortunately the best that the security industry has been able to deliver. Trying to wrangle complexity by adding more complexity is the craziest notion to me. Yes, no scoring scheme is perfect, but when the scheme introduces more noise, what have we gained (well, security vendors gain, but what have organizations gained).
    • selfmodruntime 2y ago
      This is my research field. Do you have any input you can think of at the top of your head?
      • ngneer 2y ago
        That's very cool. You probably know more about it than I do, then, but my advice is to articulate the exact problem you try to solve. I expect your field is probably teeming with AI proposals or offers on how to manage vulnerabilities, but that is doubtful the way, because again it is adding complexity, and no classifier is perfect, especially when scanners fail to understand scanned applications and their threat models or environment. Stop selling external scanners, start simplifying code? This will never work, of course, because security vendors sell the promise of security to those willing to buy it, in the form of add-on products and capabilities. Empower people to ignore scanner reports without so much red tape? That would never work either, because megacorp wants compliance and reduced liability. Build secure systems as opposed to cataloging and scoring flaws? That would never work, because building secure systems is hard, nature tends to favor otherwise. Charge people for adding complexity and credit them for removing complexity? Sadly, there is no way to do that, especially since products must ship and quality is hard to observe, since it is often invisible and only surfaces when things are broken. Off the top of my head, would be nice to require proof of exploitation, by adding CTF-like capabilities to apps, such that only if the flag is captured do we consider the report real. This places more burden on scanners, in that it is no longer enough to report an outdated library. Requiring some proof of exploitability reduces noise and increases SNR, reducing false positives. Naturally, not all vulnerabilities have working exploits, and scanners can never fully simulate an adversary, so we may get more false negatives, but at least we would not have to waste so much time upgrading pointless modules and breaking applications to appease a false report. So the idea is "here is a dummy asset, show me how you leaked or compromised it". Adding the dummy asset should be cheap, but would force scanners to better simulate an attack. At the very least, there ought to be a knob to decrease scanner sensitivity.
  • elric 2y ago
    Solving this problem in a generalized way is really hard. Maybe I have a dependency on Foo which has a critical vulnerability in a feature that I don't use. I suppress the warning and all is well. Then two weeks later someone on my team decides to use that feature, not knowing that there's a problem with it. Now we're fucked, and we'll never know because the vulnerability has been suppressed.
• sepositus 2y ago
  I don't know of anyone who doesn't quickly become exhausted after running a CVE scanner on their code.
• gcr 2y ago
  These sound like downstream effects of funding stress to me, no?
• tdb7893 2y ago
  The scores were never going to be that accurate across people's environments (IDK how much other places relied on them, places I worked never did that much) and issues with the scores don't seem to be a good justification to torch the whole CVE system anyway.
  • hashstring 2y ago
    This^ and to add to that, at the very least MITRE assigned IDs which is great. Plus they did an initial scoring, which, well… will never be perfect like you said and I’m sure these things evolve throughout time and get better (not talking necessarily CVSS vX). What a shame on this current gov. administration, if you can even call it that.
  • mike_hearn 2y ago
    Why isn't it a good justification? I think the question everyone in this thread should ask is: why is it the government's job to do this, especially given the prior widespread view that they're doing a bad job? Is the software industry so immiserated by poverty that it cannot organize its own distribution of security bulletins? Clearly not: GitHub already runs its own vuln tracking scheme that's better integrated with the tooling we use for open source software. The industry routinely sets up collaborations like standards bodies, information sharing groups and more. And there is as whole ecosystem of security companies to help you understand vulns in your stack. So there seems nothing specific to CVEs that requires government involvement, but the existence of the tax funded scheme does discourage the creation of competitors that might function better. But, to CVE or not to CVE ... that is not the question. US deficit spending is out of control. This sort of thing had to happen some day. It's what Europeans in the 2010s called "austerity" and it always makes some people scream but this graph: https://fiscaldata.treasury.gov/americas-finance-guide/national-debt/ https://fiscaldata.treasury.gov/americas-finance-guide/natio... ... is not sustainable. Up to 1984 overall US debt was stable. Since then its growth rate became dangerous. Debt/GDP ratio is now worse than just after WW2. The federal government is currently spending more on interest than on defense or Medicare: https://www.crfb.org/blogs/interest-costs-have-nearly-tripled-2020 https://www.crfb.org/blogs/interest-costs-have-nearly-triple... The US is currently getting its first taste of what parts of Europe started going through in 2008, and unfortunately there's bad news: the cuts you're seeing now are mostly cosmetic. They're what can be done within the current framework of laws, sort of, with lots of bending of the rules and creative interpretations of them and maybe some oversteps. But it's just the start of what's needed. Large scale reform of the laws themselves will be required regardless of whoever wins the next elections.
• cantrecallmypwd 2y ago
  This is bikeshedding. The point is an authoritative process and an identifier All this does is help Putin and other rich grifters.
  • GolberThorce 2y ago
    you like to say word 'bikeshedding', adoption of formal intellectualish sounding terminology even when inappropriate is orange-site affliction I advise against. I am saying this for your own sake... speak truths with POWER
    • benatkin 2y ago
      It's a legitimate term. It's like criticizing use of the word startup or demanding someone put a dash in frontend or backend.
      • GolberThorce 2y ago
        term is real... but is more like criticizing misuse of word startup. to be even more accurate it is what I said and not anything else
        • benatkin 2y ago
          Maybe you don't see how it's bikeshedding. Ah well, let me try to explain. It's because it's like if someone had forgotten to validate the user's role in an endpoint in a Django app, and someone said that they should have used Rails because it's easier to understand. In reality both are easy enough to understand to be able to do an authorization check, and the framework isn't the issue. So the person suggesting Rails is bikeshedding. Likewise, if someone made another vulnerability database it would likely have the same issue, and this isn't really the place to solve it. If somehow this does trigger the realization to solve it, then it will be by luck.
          • stavros 2y ago
• aprilthird2021 2y ago
  Sure. There's also major problems with the video encoding pipeline at my big tech job. Let's just delete it
• ajross 2y ago
  > Weren't there major problems with the current CVE implementation Absolutely. And if the headline was "DHS proposes improvements and streamlining to the CVE program" we'd all probably be cheering. Leaping from "This is Flawed" to "Let's kill This" is a logical fallacy. A flawed security registry is clearly better than no security registry.
  • GolberThorce 2y ago
    There are a lot of logical fallacies. Have you heard of the sunk-cost one? Or fallacy fallacy maybe? Or ten-tendril eschatomon fallacy? In honesty to say "logical fallacy" is spoddy, I advise against for aesthetic reason.
• worthless-trash 2y ago
  This will get lost in the noise, but i think you mean cvss. CVE is simply identification of a flaw, not a scoring system.
• bjackman 2y ago
  As an active consumer of CVEs: yea there are major problems. No there's nothing better and no I don't have any better ideas. The scores are mostly useless, I would not care if they disappeared, I do not look at them. I don't really understand why people get so upset about garbage scores though. If a high CVSS score creates a bunch of work for you then your vuln mag process is broken IMO. (Or alternatively, you are in the business of compliance rather than security. If you don't like working in compliance, CVSS scores aren't the root cause of your misery). Having a central list of "here's a bunch of things with stable IDs that you might or might not care about" is very valuable.
  • Sander_Marechal 2y ago
    > you are in the business of compliance rather than security. So, most businesses. They all need their ISO/NIST/HIPAA/etc certs.
    • bjackman 2y ago
      Yeah, most businesses need window cleaners too. If you're a window cleaner and you complain about all the birds shitting on windows, I dunno what to tell ya. If you're working in compliance either A) you're stuck in your compliance job, that sucks, CVSS scores aren't the reason why though. B) you enjoy compliance. C) you should change jobs.
      • SkyBelow 2y ago
        Often it is a second order impact. This creates a bunch of work for the compliance people, but then the compliance people end up competing a bunch of work for everyone else. If you count anyone who might have to follow compliance as working in compliance, then I purpose that there isn't enough non-compliance jobs to go around.
        • bjackman 2y ago
          Hmm I dunnno I think a) If you are having to do busywork for compliance reasons, you are either disempowered to push back on bullshit work (case A above, unfortunate, but your job was gonna suck anyway), or it's not really a second order effect, you work in compliance in a meaningful way. b) Compliance bullshit seems to expand into the space available to it. Nobody thinks CVSS scores are meaningful, the fact that they feed into compliance processes is not the CVSS scores' fault it's the compliance machine just globbing onto random bullshit as its expansion continues. If you took away CVSS scores it feels like it would just glob onto something else instead. Anyway, in the end I think we aren't disagreeing about that much. I think they're silly, if someone wanted to get rid of them I wouldn't try to defend them at all. I just wouldn'e be the person to push for that.
• bamboozled 2y ago
  Getting a bit tired of posts like this (no offense), something dumb / nefarious happens like funding is cut for <useful thing>, then someone posts an off the cuff comment or question like, "wasn't this <useful thing> not that useful because <superficial reason>?". Why do people do this, to down play all the destruction of the last few months? Seems to be some type of coping mechanism.
• rco8786 2y ago
  Every system has problems. The challenge is to address the problems and fix them. Not just delete the entire system and claim a win.
• declan_roberts 2y ago
  Yes it earnestly needed new direction and leadership.
• bearjaws 2y ago
  Classic "oh its broken so throw it all away". It's the way it is because there isn't a good alternative. They cannot possibly know every environment that we operate in. To this day we still have large corporations down playing their issues, and it was way worse 20 years ago.