|
Members of MITRE CVE Team in Attendance Christine Deal Jonathan Evans Chris Levendis 3:55 – 4:00: Action items, wrap-up
§The group reviewed the active and pipeline CNA list and assigned industries. §The podcast planning is underway; the group agreed to use Skype or MS Teams and a tentative date is scheduled for June 11. §Jonathan will provide an updated list of vendors based on the CVE IDs requested from MITRE. §Successful non-US meetings were held with European and Asian participants (Taki attended, and JP-CERT is interested in attending future meetings) §The virtual summit is scheduled for Monday, October 19, 2020, from 1:00 p.m. to 5:00 p.m. ET. §Matt B/Joe W. provided an overview of the CVE Entry states for the feedback for the Entry Submission and Upload Service. §Focused on general design document around container tagging for EOL and service tags §Starting to talk through how new tags will get added: How will the proposals be processed and approved and assigned to the right working group (e.g., CNA specific tags)? §Also discussing different types of tagging around reference types §Dave explained that we need a place to host the list, valid tag names, valid reference types, etc. §The document was sent to the CNA list for feedback on May 21. §Next step is to tech edit the document and then send to CVE Board for approval and program acceptance. §Received six CNA requests since the last CVE Board meeting (held on 5/13/20): §Four CNA announcements since last CVE Board meeting: GitLab, OpenVPN Inc., NortonLifeLock and Sierrawireless §There are now 127 CNAs participating in the program in 21 countries §103 in total CNA pipeline: 15 in Q3'19; 16 in Q4’19; 23 in Q1’20 and 17 in Q2’20 – CNAs missing disclosure policies and/or advisory locations (as required based on CNA rules 3.0) §We have emailed CNAs that are missing disclosures policies and/or advisory locations. We have emailed 19 CNAs and we have received the requested information from 8 CNAs; 11 are outstanding. §The initial translation is finished and we are now reviewing the slides internally. This is taking a bit long, as the amount of our coordination work has increased more than we expected. Therefore, although things are still moving forward, not everything (including our PR team review) will be finished by the end of May as we planned.
DWF Postmortem discussion: Lessons learned and opportunities going forward
|
|
I wanted to resurface the Physical Attack Discussion. I think we agreed to update the counting rules to reflect the conversation below. Intel is planning to update our Bug Bounty Scope guidance to clarify the physical attack scope. I wondered what the next steps are for the CVE program? 3:55 – 4:00: Action items, wrap-up §The podcast planning is underway; the group agreed to use Skype or MS Teams and a tentative date is scheduled for June 11. §Jonathan will provide an updated list of vendors based on the CVE IDs requested from MITRE. §Successful non-US meetings were held with European and Asian participants (Taki attended, and JP-CERT is interested in attending future meetings) §The virtual summit is scheduled for Monday, October 19, 2020, from 1:00 p.m. to 5:00 p.m. ET. §Matt B/Joe W. provided an overview of the CVE Entry states for the feedback for the Entry Submission and Upload Service. §Focused on general design document around container tagging for EOL and service tags §Starting to talk through how new tags will get added: How will the proposals be processed and approved and assigned to the right working group (e.g., CNA specific tags)? §Also discussing different types of tagging around reference types §Dave explained that we need a place to host the list, valid tag names, valid reference types, etc. §The document was sent to the CNA list for feedback on May 21. §Next step is to tech edit the document and then send to CVE Board for approval and program acceptance. §The initial translation is finished and we are now reviewing the slides internally. This is taking a bit long, as the amount of our coordination work has increased more than we expected. Therefore, although things are still moving forward, not everything (including our PR team review) will be finished by the end of May as we planned.
DWF Postmortem discussion: Lessons learned and opportunities going forward
|