 |
Margie Zuk and Pete Tasker talk CVE at
the National Information Systems Security Conference (NISSC)
in Baltimore, Maryland in October. |
 |
Margie explains the finer points of CVE
at NISSC. |
Bringing all the pieces together
Margie Zuk
June 2001
One manager's perspective of CVE
In 1999, MITRE saw a need for a list that would provide one common
name for publicly known information security vulnerabilities and
exposures. At the time, these vulnerabilities were known by a number
of different names. Consequently, if a company wanted to buy a security
product, it was hard to figure out which vulnerabilities or exposures
the product covered, or if two products overlapped. In response,
The MITRE Corporation created the Common Vulnerabilities and Exposures
(CVE) List to aid our sponsors, customers, and the general public
in information security.
MITRE's CVE project is a diverse one. It involves community collaboration,
promotion and publicity, Web site management, technical content
management, and funding. "Managing all these elements brings
together many different parts of MITRE," says CVE Project Manager
Margie Zuk. "We reprioritize plans all the time because CVE
naturally grows into new things as we learn more."
CVE IS SIMPLY A LIST THAT PROVIDES COMMON NAMES FOR PUBLICLY KNOWN
INFORMATION SECURITY VULNERABILITIES AND EXPOSURES. THE CONTENT
OF CVE IS A RESULT OF A COLLABORATIVE EFFORT OF THE CVE EDITORIAL
BOARD THAT IS MADE UP OF A NUMBER OF ORGANIZATIONS, INCLUDING INDUSTRY,
GOVERNMENT, AND ACADEMIA. THE MITRE CORPORATION MAINTAINS CVE AND
MODERATES EDITORIAL BOARD DISCUSSIONS.
"CVE has been a great project for me," says Zuk. "I
have the unique opportunity to work with many people in the community.
MITRE collaborates with more than 30 different organizations—security
tool vendors, members of academia, research institutions, government
agencies, and other security experts—to maintain CVE.
"The various promotional aspects of the project are important
for MITRE," continues Zuk. "MITRE is often represented
at conferences through the submission of technical papers. With
CVE we go one step further and plan, organize, and staff informational
booths at major information security conferences.
"Another aspect of the project that is new to me has been
maintaining the many aspects of the public CVE
Web server,"says Zuk. "The content for the CVE Web
site is truly a collaborative effort—it requires input from
various parts of MITRE, including Corporate Infrastructure Services,
Corporate Communications, and the Information Security Division
We also put a lot of effort into maintaining the security of the
server from an operational perspective."
Keeping current in a field that is constantly evolving is not
easy. "The technical content team, led by Steve Christey, provides
an incredible amount of support in a field that is invariably changing,"
says Zuk.
"I've loved working on CVE," she adds. "It's been
an incredible experience. MITRE has such a great team of professionals."
|
