Re: CVE ID Syntax - Seeking Suggestions for Outreach

[Art Manion <amanion@cert.org>]

On 2014-04-02, 15:22 , tk blast wrote:
> I will also help through my social and media channels to spread the word
> but let me ask this question if appropriate:  if all the expanded
> communication and outreach to educate the public succeeds, what does
> that success look like?  Don't know if this is the appropriate time to
> ask but I for one like knowing when I have hit the goal line so I can
> stop running with the ball :-)

There are issues with publishing test CVE IDs using the new syntax, but
how else do we measure the absence of problems when the trigger isn't
naturally occurring (yet)?

I'd suggest either doing a semi-formal awareness raising campaign and
declaring success (the measure being that the campaign is complete), or
counting failures of software and processes to handle the new syntax,
either with test cases or waiting until it happens live.

Might be good enough to just execute the awareness campaign, and be
prepared to warn again when we're in sight of the roll-over.

 - Art


> On Wed, Apr 2, 2014 at 9:01 AM, Steven M. Christey <coley@mitre.org
> <mailto:coley@mitre.org>> wrote:
> 
>     All,
> 
>     In recent months, MITRE has been working on public communications for
>     the CVE ID syntax change.  We would like suggestions from the
>     Editorial Board about how to further expand our outreach and educate
>     the public.
> 
>     1) We published more detailed technical guidance for implementers to
>        find and address issues related to the syntax change:
> 
>            http://cve.mitre.org/cve/__identifiers/tech-guidance.html
>     <http://cve.mitre.org/cve/identifiers/tech-guidance.html>
> 
>        This page includes some extensive testing data so that
>        implementations can have confidence that they have sufficiently
>        addressed the ID syntax.  For example, we have lists of dozens of
>        valid identifiers that could indicate parsing issues (such as
>        CVE-2014-2147483648 for triggering 32-bit representation problems),
>        and hundreds of invalid identifiers, some of which were drawn
>        directly from real-world requests to the CVE web site.
> 
>     2) We have also been gathering contact information for CVE-compatible
>        vendors, and we expect to email them shortly.  However, it's likely
>        that many of our contacts are from the marketing side of the
>        organization, so we might not always reach the right technical
>        people.
> 
>     3) We continue to periodically remind the public of the syntax change
>        through the cve-announce mailing list, Twitter, and LinkedIn.
> 
>     4) We have been making syntax-related code changes to our own web
>        sites and internal processes.  For example,
>        http://cve.mitre.org/cgi-bin/__cvename.cgi?name=CVE-2014-1012
>     <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-1012> now
>        provides a custom page that educates consumers about potential
>        truncation problems and the ID protection block, and
>        http://cve.mitre.org/cgi-bin/__cvename.cgi?name=CVE-2014-__a1012
>     <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-a1012>
>        provides more specific error messages when CVE IDs are malformed.
> 
>     5) We have mentioned or focused on the syntax in talks that we've
>        given, especially in the last year, and will continue to do so.  We
>        are also considering offering a webinar.
> 
>     Despite these efforts, there are indications that we are not reaching
>     everybody who needs to handle the change, especially the developers of
>     CVE-compatible or CVE-using products.
> 
>     There also seems to be little press interest, as the syntax change is
>     probably regarded as "old news."
> 
>     We would like suggestions from the Board about how we can reach the
>     right people.
> 
>     For example:
> 
>     * Are there Board members who are willing to announce the change
>       and/or post educational material to their customer base?  If so,
>       what form would be the most useful - PowerPoint slides, a web page,
>       newsletter, webinar, etc.?
> 
>     * Would it be effective for us to encourage implementers to announce
>       when they have achieved "compliance" with the new syntax, and then
>       publicize these vendors?  Would this be useful in fostering some
>       competiveness to drive organizations to a resolution?
> 
>     * Are there ways that we can help customers to directly engage with
>       their vendors to ensure that the issues are addressed?  We have not
>       yet directly emphasized customers in our outreach, but they might be
>       the most effective in contacting the right people within the vendors
>       and getting resolution.
> 
>     Any other ideas or suggestions are welcome and encouraged!
> 
>     If there is sufficient interest or need, we could have another
>     Editorial Board teleconference that is focused on this topic.
> 
> 
>     Thank you!
> 
>     - Steve
> 
> 
> 
> 
> -- 
> 
> Tim "TK" Keanini
> mbl 415 328 2722
> twtr @tkeanini
>