Summit D Summit Days ays The V he Value of alue of Global V - - PowerPoint PPT Presentation

FIRST TC @ KYOTO Kyoto 2012 FIRST Technical Colloquium 13-15 November 2012 Futur Future e of

• f Global V

Global Vulner ulnerability bility Repor eporting ting Summit Summit

Summit D Summit Days ays

The V he Value of alue of Global V Global Vulner ulnerability R bility Repor eporting ting

Masa Masato to Ter erada ada IT IT Security Security Center Center, , IP IPA

No November 13, 2012 ember 13, 2012

FIRST TC @ KYOTO Kyoto 2012 FIRST Technical Colloquium 13-15 November 2012

2

con conten tents. ts.

 Vulnerability Vulnerability Ident Identifier ifier  vulnerability vulnerability identifica identification. tion.  # of vulnerabilities. # of vulnerabilities.

FIRST TC @ KYOTO Kyoto 2012 FIRST Technical Colloquium 13-15 November 2012

3

 How many vulnerability identifiers are there in our cyberspace ? vulner vulnerability bility identifier identifier.

FIRST TC @ KYOTO Kyoto 2012 FIRST Technical Colloquium 13-15 November 2012

4

 How many vulnerability identifiers are there in our cyberspace ?

 Database Database  Regional/national vulnerability databases NVD, JVN, CNVD etc.  Non-government vulnerability databases Secunia, SecurityFocus, OSVDB, Cisco Security Intelligence Operations, IBM ISS X-Force etc.  Vendor Advisories Vendor Advisories  Microsoft, Oracle, Cisco, Adobe etc.

vulner vulnerability bility identifier identifier.

FIRST TC @ KYOTO Kyoto 2012 FIRST Technical Colloquium 13-15 November 2012

5

vulner vulnerability bility identifier identifier. http://nvd.nist.gov/

 NVD NVD (Nationa (National l Vulnerability Vulnerability Database) Database)  ID(4 + 4 digits): CVE-2012-1234  Lang: English  CVE mapping: one-to-one  URL: http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2012-1234

FIRST TC @ KYOTO Kyoto 2012 FIRST Technical Colloquium 13-15 November 2012

6

vulner vulnerability bility identifier identifier. http://jvn.jp/

 JVN(Japan JVN(Japan Vulnerability Vulnerability Database) Database)  ID(8 digits): JVN#12345678  Lang: Japanese/English  CVE mapping: one-to-one  URL: http://jvn.jp/jp/JVN12345678

FIRST TC @ KYOTO Kyoto 2012 FIRST Technical Colloquium 13-15 November 2012

7

vulner vulnerability bility identifier identifier. http://jvndb.jvn.jp/

 JVN JVN iPedia iPedia  ID(4 + 6 digits): JVNDB-2012-123456  Lang: Japanese/English  CVE mapping: one-to-one  URL: http://jvndb.jvn.jp/jvndb/JVNDB-2012-123456

FIRST TC @ KYOTO Kyoto 2012 FIRST Technical Colloquium 13-15 November 2012

8

vulner vulnerability bility identifier identifier. http://www.cnvd.org.cn/

 CNVD(China CNVD(China National Vulnerability National Vulnerability Database) Database)  ID(4 + 5 digits): CNVD-2012-12345  Lang: Chinese  CVE mapping: one-to-one  URL: http://www.cnvd.org.cn/sites/main/preview/ldgg_preview.htm?tid=61059

FIRST TC @ KYOTO Kyoto 2012 FIRST Technical Colloquium 13-15 November 2012

9

vulner vulnerability bility identifier identifier. http://secunia.com/

 Secunia Secunia  ID(5 digits): SA12345  Lang: English  CVE mapping: one-to-many  URL: http://secunia.com/advisories/12345

FIRST TC @ KYOTO Kyoto 2012 FIRST Technical Colloquium 13-15 November 2012

10

vulner vulnerability bility identifier identifier. http://www.securityfocus.com/

 Secur SecurityFocus ityFocus  ID(variable digits): 12345 (aka. bid12345)  Lang: English  CVE mapping: one-to-many  URL: http://www.securityfocus.com/bid/12345

^^^^^^ current longest id is 5 digits

FIRST TC @ KYOTO Kyoto 2012 FIRST Technical Colloquium 13-15 November 2012

11

vulner vulnerability bility identifier identifier. http://osvdb.org/

 OSVDB OSVDB (The

(The Open Open Source Source Vulnerability Vulnerability Database) Database)

 ID(variable digits): 12345  Lang: English  CVE mapping: one-to-many  URL: http://osvdb.org/show/osvdb/12345

^^^^^ current longest id is 5 digits

FIRST TC @ KYOTO Kyoto 2012 FIRST Technical Colloquium 13-15 November 2012

12

vulner vulnerability bility identifier identifier. http://tools.cisco.com/security/center/

 Cisco Cisco Secur Security ity Inte Intelligence Operations lligence Operations  ID(5 digits): 12345  Lang: English  CVE mapping: one-to-many  URL: http://tools.cisco.com/security/center/viewAlert.x?alertId=12345

FIRST TC @ KYOTO Kyoto 2012 FIRST Technical Colloquium 13-15 November 2012

13

vulner vulnerability bility identifier identifier. http://xforce.iss.net/

 IBM IBM ISS ISS X-Force Force  ID(short subject + variable digits): speak-freely-udp-bo (12345)  Lang: English  CVE mapping: one-to-many  URL: http://xforce.iss.net/xforce/xfdb/12345

<<<<< current longest id is 5 digits

FIRST TC @ KYOTO Kyoto 2012 FIRST Technical Colloquium 13-15 November 2012

14

 How do we make a relationship of vulnerability information ? vulner vulnerability bility identifica identification tion.

FIRST TC @ KYOTO Kyoto 2012 FIRST Technical Colloquium 13-15 November 2012

15

 How do we make a relationship of vulnerability information ?

 Currently, we can use Common Vulnerabilities and Exposures (CVE), which is the most well known vulnerability identification scheme.

vulner vulnerability bility identifica identification tion. CVE is best and unique reference ID in world wide.

FIRST TC @ KYOTO Kyoto 2012 FIRST Technical Colloquium 13-15 November 2012

16

 How many # of vulnerabilities ? # of # of vulne vulnerabilities. bilities.

FIRST TC @ KYOTO Kyoto 2012 FIRST Technical Colloquium 13-15 November 2012

17

1,000 2,000 3,000 4,000 5,000 6,000 7,000 8,000 1995 1996 1997 1998 1999 2000 2001 2002 2003 2004 2005 2006 2007 2008 2009 2010 2011 2012 NVD CERT/CC Number of vulnerabilities

# of # of vulne vulnerabilities. bilities. http://nvd.nist.gov/

 NVD NVD (Nationa (National l Vulnerability Vulnerability Database) Database)

Total; 53,262

FIRST TC @ KYOTO Kyoto 2012 FIRST Technical Colloquium 13-15 November 2012

18

# of # of vulne vulnerabilities. bilities. http://www.cnvd.org.cn/

 CNVD(China CNVD(China National Vulnerability National Vulnerability Database) Database)

1,000 2,000 3,000 4,000 5,000 6,000 7,000 1999 2000 2001 2002 2003 2004 2005 2006 2007 2008 2009 2010 2011 2012 CNVD Number of vulnerabilities

Total; 39,796

FIRST TC @ KYOTO Kyoto 2012 FIRST Technical Colloquium 13-15 November 2012

19

# of # of vulne vulnerabilities. bilities. http://secunia.com/

 Secunia Secunia

Average 2006-10; 8,663 Total 2011; 9,132

FIRST TC @ KYOTO Kyoto 2012 FIRST Technical Colloquium 13-15 November 2012

20

end ending. ing.

Global V Global Vulner ulnerability bility Repor eporting will pr ting will provide bes vide best t solution solution of

• f this qu

this question estions. s.