The US Cybersecurity and Infrastructure Security Agency (CISA) has been named a Top-Level Root CVE Numbering Authority (CNA), it will be overseeing CNAs in assigning CVE identifiers for vulnerabilities in industrial control systems (ICS) and medical devices.
Each CNA is responsible for issuing CVE identifiers for vulnerabilities that were found in products, while a Top-Level Root CNA manages a group of CNAs belonging to the same domain or community and may assign CVE IDs to vulnerabilities.
Currently, CISA and MITRE are the only Top-Level Root CNAs, there are also 139 CNAs across 24 countries.
CISA will be in charge of ICS and medical device vendors that are CNAs, it will supervise the process to assign CVE identifiers. Other tasks include the implementation of rules and guidelines of the CVE Program, the resolution of disputes, and the recruitment of new CNAs.
The CNAs managed by CISA are Alias Robotics, ABB, CERT@VDE, Johnson Controls, Bosch, Siemens and Gallagher Group.
“As the Top-Level Root for ICS and medical devices, CISA is responsible for ensuring the effective assignment of CVE IDs, implementing the CVE Program rules and guidelines, and managing the CNAs under its care. It’s also responsible for recruitment and onboarding of new CNAs and resolving disputes within its scope.” reads the press release from CISA and Mitre.
“Establishing CISA as a Top-Level Root consolidates the vast expertise required to effectively assign CVE IDs to ICS and medical device vulnerabilities and enables the rapid identification and resolution of issues specific to those environments,”
The work of CISA will enable the rapid identification and resolution of ICS and medical device vulnerabilities.
The US Agency have to promote information sharing to help stakeholders in beign up to date on vulnerabilities and the associated risks.
Recently the OT and IoT security firm Nozomi Networks announced that it has become a Common Vulnerabilities and Exposures (CVE) Numbering Authority (CNA).
(SecurityAffairs – hacking, CNA)
Necessary cookies are absolutely essential for the website to function properly. This category only includes cookies that ensures basic functionalities and security features of the website. These cookies do not store any personal information.
Any cookies that may not be particularly necessary for the website to function and is used specifically to collect user personal data via analytics, ads, other embedded contents are termed as non-necessary cookies. It is mandatory to procure user consent prior to running these cookies on your website.