Connect with us
Categories:
X

Technology

The exploitability advisory: CISA’s VEX provides a novel approach to addressing identified vulnerabilities

Published

on

The exploitability advisory: CISA's VEX provides a novel approach to addressing identified vulnerabilities
Share this post:

A new twist on security advisories promises to optimize the triaging of vulnerabilities by highlighting whether flaws are not just present within software but practically exploitable, too.

Developed by the US government, the vulnerability exploitability exchange (VEX) enables “both suppliers and users to focus on vulnerabilities that pose the most immediate risk” and avoid wasting time on bugs with no impact, according to use cases (PDF) published by the US Cybersecurity & Infrastructure Security Agency (CISA) in April 2022.

As CISA vulnerability analyst Justin Murphy puts it: if a software bill of materials (SBOM) “turns on flashing lights on the dashboard, VEX helps you figure out which ones you have to turn off”.

Speaking at the recent Linux Security Summit in Dublin, Ireland, Murphy said this “negative security advisory” supplements the provision of a product’s ‘ingredients’ by SBOMs, which President Biden has decreed should be a precondition for the government purchase of software.

Vulnerable_code_not_in_execute_path

VEX advisories, which emerged from a National Telecommunications and Information Administration (NTIA) project, advise whether a product is ‘affected’, ‘not affected’, ‘fixed’, or ‘under investigation’ in relation to a particular bug.

As detailed (PDF) by CISA, the ‘not affected’ designation could be accompanied by ‘status justifications’ such as:

  • Component_not_present
  • Vulnerable_code_not_present
  • Vulnerable_code_cannot_be_controlled_by_adversary
  • Vulnerable_code_not_in_execute_path
  • Inline_mitigations_already_exist

Murphy suggested a specific scenario in which “you have a third-party dependency and it says the code is vulnerable, but since the compiler rips it out you’re not actually affected”. Alternatively, he continued, a product might use a vulnerable library but not its vulnerable functions, or contain protections around input validation.

In providing information about exploitability, suggested Murphy, VEX advisories usefully augment SBOMs and the Known Exploited Vulnerability Catalog, which CISA launched in the fall of 2021.

Machine readability

The proliferation of CVEs and therefore security advisories has made tackling known vulnerabilities a “data management problem”, said Murphy.

And the problem is complicated by the fact advisories come in various formats, hampering not just machine readability but also “human readability in some cases”.

Asking the maintainer about flaws – “will you even get a response?” – or conducting your own, time-consuming investigation are hardly superior alternatives, argued Murphy.

This context helps explain CISA’s focus on interoperability and the fact VEX advisories can be implemented in the machine-readable OASIS CSAF standard.

Name confusion

Aspirations to link SBOM and VEX data are complicated by the lack of a universally agreed upon system of common identifiers for software components, conceded Murphy.

As such, security teams are at risk of erroneously misunderstanding their stack’s exposure when, for example, separate SBOMs inadvertently use differing identifiers for the same component or the same identifier for different components.

A comprehensive component identification system probably needs to address this problem “through aliases or equivalency relationships”, suggested Murphy, perhaps using a combination of common platform enumeration (CPE), package URLs (purls), SWID tags, SWHIDS, and GitBOM.


Get More Stories Like This On: Facebook: @AllNaijaEntertainment, Twitter: @AllNaijaEntertainment

Cryptocurrency
Technology12 hours ago

Meaning and Uses for Tether Crypto Explained

Bitcoin Cryptocurrency
Technology4 weeks ago

Have A Brief Idea About Bitcoin Mining And Its Operation

Mark Your Calendars For These 4 Premier Sporting Events Of 2023
Sports1 month ago

Mark Your Calendars For These 4 Premier Sporting Events Of 2023

How To Safeguard Your Crypto Wallet?
Technology2 months ago

How To Safeguard Your Crypto Wallet?

Angry youths chase Elumelu away as they disrupt PDP campaign in Delta
News2 months ago

Angry youths chase Elumelu away as they disrupt PDP campaign in Delta

Lai Mohammed
News2 months ago

FG recovers over N120bn from proceeds of crime – Lai Mohammed

News2 months ago

Tinubu says Peter Obi, Atiku lack track record to be president

Atiku Abubakar
News2 months ago

Plateau PDP set to receive Atiku

Peter Obi praises Gov Uzodimma’s leadership style
News2 months ago

Peter Obi praises Gov Uzodimma’s leadership style

Entertainment2 months ago

‘Free Mind’ by Tems enters 20th week on Billboard Hot 100

Kizz Daniel
Entertainment2 months ago

Buga by Kizz Daniel is the most searched song in Nigeria in 2022

News2 months ago

NJC Reinstates Justice Ofili-Ajumogobia As Judge Of Federal High Court

Man sentenced to 21 years in prison for stealing Lady Gaga's dogs
Entertainment2 months ago

Man sentenced to 21 years in prison for stealing Lady Gaga’s dogs

NNPC Ltd to disclose new asset base – Kyari
News2 months ago

Nigeria Records ₦‎16 Trillion Worth Of Crude Oil In 9 Months

Entertainment2 months ago

Broda Shaggi begs African fathers to hug their children

News2 months ago

Chatham House: APC slams Dele Momodu over comment on Tinubu

News2 months ago

Samuel Eto’o Apologises After Physically Attacking YouTuber

News2 months ago

N-Power Fraud: D’banj Arrested & Detained – ICPC Confirms, Releases Statement

News2 months ago

FG: Second Niger Bridge will open to traffic Dec 15

News2 months ago

2023 Polls Won’t Mar Nigeria – Sultan, CAN, SGF

Education2 months ago

ASUU Strike: CONUA threatens to sue FG over withheld salaries

Sports2 months ago

Eden Hazard announce retirement from international football

News2 months ago

2023: APC Has Failed Northerners, Muslim-Muslim Ticket Won’t Work – Shagari

News2 months ago

Teleprompters In Sight As Tinubu Spoke At Chatham House – Jaafar Shares Photo

Buhari
News2 months ago

2023: No manipulations of any form will be allowed, Buhari vows

News2 months ago

Kano Hisbah to destroy 18,000 bottles of beer

Entertainment2 months ago

Emancipation: Will Smith pulls you in with gritty realities of slavery era[Review]

Will Smith hopes ‘brutal’ depictions of slavery in Emancipation are ‘not in vain’, as he attends premiere in London
Entertainment2 months ago

I became more alive by facing my pain – Will Smith

Luis Enrique
Sports2 months ago

Spain manager full of praise for his players despite shock Morocco loss

Goncalo Ramos
Sports2 months ago

Goncalo Ramos reacts after taking Cristiano Ronaldo’s place in Portugal team

Frank Leboeuf
Sports2 months ago

Frank Leboeuf aims bizarre dig at Kieran Trippier

Sports2 months ago

Can the Three Lions outsmart France’s unstoppable star player?

Horoscope2 months ago

Your daily horoscope for Wednesday, December 7, 2022

Sports2 months ago

FIFA World Cup 2022: Goncalo Ramos nets first hat-trick of 2022 FIFA World Cup as Portugal trash Switzerland

Sports2 months ago

FIFA World Cup 2022: Yassine Bono the hero as Morocco knocks Spain out of World Cup

Godwin Emefiele
News2 months ago

CBN Drops ATM Withdrawal Limit To ₦‎20k/Day

TikTok logo
News2 months ago

‘TikTok Challenge’ Circulates Info-Stealing Malware – NCC

DOWNLOAD Complete Wednesday (TV series) (2022 film) Season 1 Subtitles File [English SRT] 2022
Movie Subtitle2 months ago

DOWNLOAD Complete Wednesday (TV series) (2022 film) Season 1 Subtitles File [English SRT] 2022

The vast network of antennas will form the world’s largest radio telescope
Technology2 months ago

The largest radio telescope in the world’s construction gets underway

News2 months ago

FG releases new curriculum for universities in Nigeria

ANE Billboard Hots