Revising the CVE CNA Operational Rules: AMA 

Art Manion (ANALYGENCE Labs, US)
Art Manion is the Deputy Director of ANALYGENCE Labs where he and his team perform in-depth vulnerability analysis and coordinated vulnerability disclosure. Art has lead and contributed to a variety of vulnerability-related efforts in ISO/IEC JTC 1/SC 27, the CVE Program (Board member), the Forum of Incident Response and Security Teams (FIRST), and the (US) National Telecommunications and Information Administration (NTIA). Art works closely with the (US) Cybersecurity and Infrastructure Security Agency (CISA) and previously managed vulnerability analysis at the CERT Coordination Center (CERT/CC).
---
By the time you read this, the CVE Program should be nearing the end of a year-long process to revise the CNA Operational Rules. While the overall spirit of the rules has not significantly changed, the rules themselves have been almost entirely rewritten. What happens if a CNA declines to assign a CVE ID? How does a CNA determine that a vulnerability exists? Is that one vulnerability or five? What does Janet Jackson have to do with CVE? I'm the acting editor of this revision of the CNA Operational Rules, ask me anything!

Наука