Re: The CVE (WAS: RE: RE: Ramping up for another review)

[dugsong () monkey org (Dug Song)]

Archive: http://msgs.securepoint.com/ids
FAQ: http://www.ticm.com/kb/faq/idsfaq.html
IDS: http://www-rnks.informatik.tu-cottbus.de/~sobirey/ids.html
UNSUBSCRIBE: email "unsubscribe ids" to majordomo () uow edu au
On Sat, 15 Jul 2000, Greg Shipley wrote:

> you're not an religious FreeBSD user, are you?

ooh, them's fightin' words! strictly OpenBSD, sir. :-)

> honestly, do you really think that Cisco and ISS are going to screw
> up, say, an attack on wu-ftpd and confuse it with something else?

no, i'm saying that we don't have a common way to describe attacks now,
which is a major hinderance to any REAL interoperability. the problem with
simply enumerating attacks, as the CVE does, is that not everyone counts
them the same way - what one IDS calls "overlapping IP fragments" another
may call "teardrop", and yet another "newtear". how useful are these names
by themselves?

> What I was looking at a year ago was typical of academia land: debate
> the 10,000ft view and theoretical proofs of something until you are
> blue in the face and never implement anything worthwhile.

the UC Davis Seclab Vulnerabilities project, Krsul's thesis at Purdue,
Ulf Lindquist's taxonomy in IDLE, etc. all provided open frameworks for
describing and classifying vulnerabilities and attacks; it's a shame
nothing more became of them, but then the CVE really didn't have to start
from scratch...

> >     http://www.commoncriteria.org/
>
> I'm not qualified to comment on this one.  :)

the CC is at least as lame as any other certification program
(technically, perhaps even worse), but at least it pretends to be based on
some kind of sound engineering and testing principles, if that's really
what you're looking to the CVE to provide.

i'm just concerned that we've given up on real testing and evaluation
methodology in favor of simple marketing feature checklists; i suppose
this is a problem with the software industry in general, but i hate to see
computer security follow the trend.

-d.

http://www.monkey.org/~dugsong/