search

oasis-open / csaf-documentation

OASIS TC Open Repository: A GitHub repository for management of non-normative information about the work of the CSAF Technical Committee, including documentation
https://oasis-open.github.io/csaf-documentation/
BSD 3-Clause "New" or "Revised" License
19 stars 13 forks source link

How vulnerability coordinators use CSAF? #37

Open santosomar opened 2 years ago

santosomar commented 2 years ago

Create short videos (~ 2 minutes long) explaining the content described in the title of this issue. This issue is tracked in the parent issue #30

sei-vsarvepalli commented 2 years ago

CERT/CC is using CSAF currently as a rich Vulnerability format for representing all the information in our Vulnerability Notice https://kb.cert.org/vuls/ in a machine readable format. Each Vulnerability Note is available both before public release (via Private authenticated API) and after public release (via Public API) in CSAF format. More information available from Vul Note Public API and Vul Note Private API

We are also exploring some use cases as well with our Vultron protocol and potential use of CSAF for a more thorough analysis of CVD process - see Vultron Blog for more details of the proposed protocol. This long term plan for CSAF includes several activities like normalizing collection of vulnerability information from security researchers, gathering product status from vendors and finally collection of all metadata related to a vulnerability from external stakeholders (blogs, patches/workarounds, scores CVSS/SSVC, GitHub SA GHSA, exploits and threats) in order to manage the lifecycle of a vulnerability or a set of related vulnerabilities.