Common Vulnerabilities and Exposures Assignment

What is a vulnerability? A vulnerability is a weakness which can be exploited in a cyber-attack to gain unauthorized access to or perform unauthorized actions on a computer system. Vulnerabilities can allow attackers to run code, access system memory, install different types of malware and steal, destroy or modify sensitive data. Common Vulnerabilities and Exposures (CVE) Common Vulnerabilities and Exposures (CVE) is a list of publicly disclosed information security vulnerabilities and exposures. CVE was launched in 1999 by the MITRE corporation to identify and categorize vulnerabilities in software and firmware. CVE provides a free dictionary for organizations to improve their cyber security. MITRE is a nonprofit that operates federally funded research and development centers in the United States. The goal of CVE is to make it easier to share information about known vulnerabilities across organizations. CVE does this by creating a standardized identifier for a given vulnerability or exposure. CVE identifiers or CVE names allow security professionals to access information about specific cyber threats across multiple information sources using the same common name. For example, UpGuard is a CVE compatible product, and its reports reference CVE IDs. This allows you to find fixed information on any CVE compatible vulnerability database. benefits of CVE allow organizations to set a baseline for evaluating the coverage of their security tools. CVE's common identifiers allow organizations to see what each tool covers and how appropriate they are for your organization. CVE means security advisories that can for vulnerabilities and check for threats can use CVE information to search for known attack signatures to identify particular vulnerability exploits as part of any digital forensics process. Look for security tools with CVE compatibility rather than proprietary vulnerability assessments, it's a great way to reduce your organization's cybersecurity risk. Common Weakness Enumeration (CWE) Common Weakness Enumeration (CWE) is a universal online dictionary of weaknesses that have been found in computer software. The dictionary is maintained by the MITRE Corporation and can be accessed free on a worldwide basis. The purpose of CWE is to facilitate the effective use of tools that can identify, find and resolve bugs, vulnerabilities and exposures in computer software before the programs are publicly distributed or sold. CWE has been assembled in three levels called tiers. The top tier divides known weaknesses into a few large, general classes for discussion among enterprise management people, academics, researchers and vendors. The middle tier consists of several dozen groups of definitions categorized for use by security experts, system administrators and software developers. The lower tier is the full list, intended for people at all levels including personal computer (PC) users. The entries in CWE are numbered for reference. CWE is compiled and updated by a diverse, international group of experts from business, academic institutions and government agencies, ensuring breadth and depth of content. CWE provides standardized terminology, allows service providers to inform users of specific potential weaknesses and proposed resolutions, allows software buyers to compare similar products offered by multiple vendors and allows legal personnel to formalize contracts, terms and conditions relevant to software use. National Vulnerability Database (NVD) The NVD is the U.S. government repository of standards based vulnerability management data represented using the Security Content Automation Protocol (SCAP). This data enables automation of vulnerability management, security measurement, and compliance. The NVD includes databases of security checklist references, security related software flaws, misconfigurations, product names, and impact metrics. Originally created in 2000 (called Internet - Categorization of Attacks Toolkit or ICAT), the NVD has undergone multiple iterations and improvements and will continue to do so to deliver its services. The NVD is a product of the NIST Computer Security Division, Information Technology Laboratory and is sponsored by the Cybersecurity & Infrastructure Security Agency. The NVD performs analysis on CVEs that have been published to the CVE Dictionary. NVD staff are tasked with analysis of CVEs by aggregating data points from the description, references supplied and any supplemental data that can be found publicly at the time. This analysis results in association impact metrics (Common Vulnerability Scoring System - CVSS), vulnerability types (Common Weakness Enumeration - CWE), and applicability statements (Common Platform Enumeration - CPE), as well as other pertinent metadata. The NVD does not actively perform vulnerability testing, relying on vendors, third party security researchers and vulnerability coordinators to provide information that is then used to assign these attributes. As additional information becomes available CVSS scores, CWEs, and applicability statements are subject to change. The NVD endeavors to re-analyze CVEs that have been amended as time and resources allow to ensure that the information offered is up to date. United States Computer Emergency Readiness Team (us cert) The United States Computer Emergency Readiness Team (US-CERT) has played an important role in public sector data security. US-CERT is a partnership between the Department of Homeland Security (DHS) and the public and private sectors. It is currently positioned within the National Cyber Security Division (NCSD) of DHS's Office of Cybersecurity and Communications. Established in 2003 to protect the nation's Internet infrastructure, USCERT coordinates the nation’s efforts to prepare for, prevent, and respond to cyber threats to systems and communication networks. The organization interacts with federal agencies, state and local governments, industry professionals, and others to improve information sharing and incident response coordination and to reduce cyber threats and vulnerabilities. It serves as a focal point for the government’s interaction with federal and non-federal entities on a 24-hour-a-day, 7day-a-week basis. US-CERT is identified by the Office of Management and Budget (OMB) to serve under FISMA as the Federal information security incident center to: Provide timely technical assistance to operators of agency information systems regarding security incidents, including guidance on detecting and handling information security incidents. Compile and analyze data about incidents that threaten information security; and Inform operators of agency information systems about current and potential information security threats and vulnerabilities. US-CERT also provides a method for citizens, businesses, and other important institutions to communicate and coordinate directly with the federal government on matters of cybersecurity. The private sector can use the protections afforded by the Critical Infrastructure Information Act to electronically submit proprietary data to US-CERT. In the event of a security issue or disruption affecting data and applications, US-CERT facilitates coordination of recovery activities with the network and security operations centers of owners and operators of these networks and with government officials (e.g., incident response teams) responsible for protecting government networks. NCSD is the government lead on a public/private partnership supporting US-CERT and serves as the lead for the federal government’s cyber incident response through the National Cyber Response Coordination Group. US-CERT provides the following support cyber security event monitoring; advanced warning on emerging threats; incident response capabilities for federal and state agencies; malware analysis and recovery support; trends and analysis reporting tools; and other support services in the area of cyber security. US-CERT also provides consumer and business education on Internet and information security.