Vulnerabilities

Vulnerabilities are different when compared to other software bugs for one simple reason: they don’t expose themselves and change the state of the system until someone triggers them intentionally. Even when the system state changes to a less secure state (e.g., exposing information), the attacker still needs to take advantage of it. In other words, it isn’t just enough to find a buffer overflow, the attacker must develop a malicious payload that can exploit it and execute the code they want.

Vulnerabilities require interacting with them to have any proof that they really are a vulnerability. If an attacker has to have knowledge of a vulnerability in order to exploit it, then it stands to reason that the defenders also have to have knowledge of the vulnerability in order to fix it. While one could make the argument that defenders must monitor your systems for compromise, and when exploited investigate and fix the problem, I think it might be more efficient to first try letting defenders know about what vulnerabilities may exist so they can take corrective action in advance of being attacked. To learn more about vulnerabilities read this blog. 

Given the increase in successful attacks against all forms of IT infrastructure it has become obvious that current efforts to track vulnerabilities using vulnerability identifiers has reached its limit. Identifiers need to be easily discovered, fast to assign,updatable, and publicly available. The number of vulnerabilities is growing faster than we are currently able to track them. As an industry we need to start talking about how to solve this problem. One way you can do this is by joining the Global Security Database Working Group. Come help us build the best vulnerability identifier out there!

CSA created the https://GlobalSecurityDatabase.org, which is building a community and processes that will result in a much better dataset than CVE has, where false positives can easily be challenged, and it will be free for use. We have a really good entry for CVE-2021-44228 if you are interested.