Removing the Pain From the Repetitive Processing of Vulnerability Reports Using a Vulnerability Ontology
No ratings
Presented at FirstConferenceKualaLumpur 2018 by
JPCERT/CC has been coordinating and disclosing software vulnerabilities since 2004 when the vulnerability handling framework was established in Japan. Over the past few years, the number of vulnerabilities that have been reported to this framework has increased sharply. Until 2014, the maximum number of reports received for a single year never exceeded 300. Since then, this number has increased significantly, with a peak number of over 1,000 in 2016. With a team of less than 10 people, traditionally manual processes such as analysis of reports and the writing of advisories have not scaled well. On the surface, while these processes seem to be independent, these processes utilize the same information to perform tasks that are essential to coordinating software vulnerabilities.For these processes to scale, automating wherever possible is essential. In order to automate these processes, JPCERT/CC thought "Is there a way where we can use a common language to communicate vulnerability information?" Vulnerability reports are typically written by people, and various terms / words can be used to describe the same issue. Reading through these various reports to identify the vulnerability and its effects as well as verifying whether there is sufficient information provided in the report for the vendor to remediate the vulnerability takes time. In our attempt to solve this problem we came across NIST IR 8138 "Vulnerability Description Ontology".We have attempted to take this ontology and see if it can be utilized to automate some of our coordination processes. In this presentation, we will discuss briefly about the ontology itself and some of its components, how it has helped in scaling our analysis process as well as how it has assisted in automating our advisory writing process. We also will consider some ways in which this information can be shared with other organizations to help assist coordination activities.