Re: CONTENT DECISION: Presence of Services or Applications (SA)

[Dave Mann <damann@mitre.org>]

> > On Tue, Aug 03, 1999 at 08:52:05PM -0500, Gene Spafford wrote:
> > > I really do not like the idea behind this category.
[snip...]

> On Wed, Aug 04, 1999 at 02:55:52PM -0500, Prosser, Mike wrote:
> > I agree with these comments as well!  Unless there is an actual
> > vulnerability related to one of these services, don't see them as
> > being CVE material just by running.  This becomes a "best practice" or
> > company policy decision rather than a vulnerability.

Aleph One wrote:
> I belive this what the words you are looking for is vulnerability vs
> risk. A service running is a risk. Not a vulnerability.


Mike, I am surprised to hear a tool vendor saying this and I
would very much like to hear the input of other tool vendors on
this one.  As a consumer of security tools, I note that security
tools most often report on things like the existence of finger
on a system.

As someone working on managing enterprise security (a different
hat from research, tool production or vulnerability discovery)
I can assure you that I NEED to be able to manage information
about the unintended presence of services or applications.
I insist that my tools be able to discover these things and
I demand that my tools be able to interoperate at this level.
This is, in fact, precisely the reason why we proposed the
idea of the CVE in the first place.

Mike and the other tool vendors, please note
that if we adopt a more narrow (and perhaps more accurate)
definition of vulnerability, then a lot of the security checks
performed by your tool(s) will not correlate to any CVE entry.
This, in turn, will undercut one of our primary goals of the
CVE which is to foster tool interoperability.

It turns out that we are discussing this issue here at MITRE
currently.  We are formulating a possible long term approach
for handling this problem.  Being more precise about the
semantics and definitions may play a role, as Elias
and Spaf have alluded to. In the mean time, I would strongly
urge others to weigh in on this issue.

As always, eagerly anticipating the input of all,

Dave


--



=========================================================
David Mann                     ||  phone: (781) 271 - 2252
INFOSEC Engineer/Scientist, Sr ||
Enterprise Security Solutions  ||    fax: (781) 271 - 3957
The MITRE Corporation          ||
Bedford, Mass 01730            || e-mail: damann@mitre.org