Is CVE the Solution for Cloud Vulnerabilities?

guest · Aug 22, 2021

Is CVE the Solution for Cloud Vulnerabilities?
August 22, 2021
https://www.infoq.com/news/2021/08/cve-cloud-vulnerabilities/

At the recent Black Hat USA 2021, security experts from cloud infrastructure company Wiz argued that a CVE database for cloud vulnerabilities is needed, starting a debate in the cloud and cybersecurity communities.

Without the support of the CVE system, a list of entries containing an identification number and at least one public reference for security vulnerabilities, it is difficult to track and manage issues that affect cloud services.
The current lack of a repository for cloud vulnerabilities gained momentum at the computer security conference in Las Vegas. Ami Luttwak, Co-Founder & CTO at Wiz, and Shir Tamari, Head of Research at Wiz, explained the current status while discussing a possible vulnerability on AWS and the importance of awareness:

IAM vulnerabilities are not tracked by NIST, do not have a CVE, and do not have scanning tools that provide IAM vulnerability scanning results. The result is that most customers are running with vulnerable IAM policies and have no process to fix them.
Click to expand...

They started a Slack channel to work on the CVE proposal and document their findings in an article. Brian Martin, CSO at attrition.org, reflects:

At times, some of the CVE (Editorial) Board has advocated for CVE to expand to cover cloud vulnerabilities while others argue against it.

This is not the first time a discussion about CVE for cloud has started. Three years ago Kurt Seifried, director of IT at Cloud Security Alliance (CSA), and Victor Chin, then research analyst at CSA, wrote an article to highlight the challenges of the current CVE rules.
Click to expand...

In a recent article, Jim Reavis, co-founder and chief executive officer at CSA, gave an update on how CSA wants to address the problem. While a solution is still discussed, Martin raises a warning:

The only thing worse than such a project not getting off the ground is one that does, becomes an essential part of security programs, and then goes away.
Click to expand...

Log in or Sign up

Is CVE the Solution for Cloud Vulnerabilities?

guest Guest

Log in or Sign up

Is CVE the Solution for Cloud Vulnerabilities?

guest Guest

Useful Searches