RE: New CNA - Booz Allen Hamilton

[jericho <jericho@attrition.org>]

On Mon, 6 Nov 2017, Coffin, Chris wrote:

: In this case, BAH was interested and was willing to participate in 
the 
: program as a CNA for their own products. They are also willing to 
fill 
: the gaps where other CNAs do not provide coverage. Our understanding 
: from the discussion was that this CNA falls into the category of a 
large 
: and established organization that should be part of the CVE program, 
: especially if they are reaching out to us to participate. It was the 
: smaller research organizations that were the issue, right?

In the interest of transparency, and because I don't know if this 
represents a conflict or not, or is tangentially related... but could 
NIST/NVD clarify BAH's current role in the NVD process?

For those not aware, for several years NIST would out-source the NVD 
meta-data generation (e.g. CPE, CVSS scoring) to junior BAH 
consultants. I 
don't know how long that went on, if it is still does, or if they 
changed 
vendors over the year.

I had asked both MITRE and NVD many years back about their involvement 
in 
the context of "when they find an error in a CVE, who do they report 
to" 
and I don't recall getting a real answer other than what in my memory 
was 
bureaucratic speak for "don't worry, it's handled".

.b