 
By Robert Vamosi A few readers also thought I was too critical of Carnegie Mellon's CERT Coordination Center (CERT/CC). I said that CERT/CC was too slow to respond to vulnerabilities because of inadequate staffing. But it turns out that is not quite correct. Rather, CERT/CC could benefit from greater financial independence from the U.S. government. Now, I believe that security companies and software vendors should support the work done by CERT/CC, rather than create a new organization. CERT's origin From its inception, CERT was designed to handle Internet emergencies. It was created shortly after Robert Morris, Jr. launched the first worm attack on the Internet in November 1988. The Morris worm brought together members of the government and academia (then the primary users of the Internet) for containment strategy sessions. Afterward, these individuals decided to form a lasting coordination center to handle future Internet security events. The Defense Advanced Research Projects Agency (DARPA) chose Carnegie Mellon's Software Engineering Institute (SEI) as the home base. Funded primarily by the Department of Defense, the General Services Administration, and other government agencies, CERT/CC raises additional support through collaborative research projects with private-sector companies. It has also received some funds from the Internet Security Alliance, a public and private partnership for Internet security.
Threat matrix To prioritize vulnerabilities, CERT/CC uses its own internal threat matrix, in which each vulnerability submitted is assigned a number between 0 and 180. You can view an example here. The number takes into account how much information is available about a vulnerability, whether it has been exploited, whether it threatens the Internet's infrastructure, how many systems are vulnerable, what damage it might cause, and how easy it is to fix and to exploit. The results are not linear; for example, a vulnerability of 60 is not twice as severe as one of 30. The threat matrix is useful for identifying more critical vulnerabilities; they're the ones with the higher numbers.
However, despite these parameters, CERT/CC has accommodated outside interests and made exceptions as recently as last February. That's when the SNMPv1 vulnerability was announced publicly. This flaw allowed malicious users to take control of a remote computer by using GetRequest, GetNextRequest, and SetRequest messages. Even though security researchers knew about this vulnerability for several months, CERT/CC delayed its announcement to the public. Hernan said, "We chose our initial release date, February 12, after extensive negotiation with the [software vendors and other interested parties]. Many wanted an earlier release, and many wanted a later release. Some wanted no release of the information." Government influence To better understand CERT/CC's delay in announcing the SNMP vulnerability, remember that it affected a long list of vendors. "The SNMP problem was pervasive, and finding, fixing, and addressing all the flaws takes considerable time and energy," said Hernan. However, some researchers have speculated that the U.S. government, not individual vendors, convinced CERT/CC to delay its SNMP announcement last February because the government feared that malicious users may have used the vulnerability to disrupt the 2002 Winter Olympics in Salt Lake City. Instead of creating an entirely new organization to police the disclosure of software vulnerabilities, as I proposed a few weeks ago, let's free CERT/CC from the influence of the U.S. government. If security and software vendors financially support CERT/CC, this would allow the organization to become a more impartial clearinghouse of data on software vulnerabilities. And this, perhaps, would make software more secure--a benefit to all of us. Do you think CERT/CC is the best organization to oversee the disclosure of software vulnerabilities? If not, how should we resolve this issue? TalkBack to me!
Senior Associate Editor Robert Vamosi covers hoaxes, viruses, and security threats for CNET Reviews. Have a question for him? Let him know! |
 |
Next steps |
 | |
| |
•
Find DSL in your own area |
• Download security and encryption apps |
• Protect yourself with a firewall or an Internet security suite |
• Shopper.com's most popular security and encryption apps
• Download security and encryption apps |
• Protect yourself with a firewall or an Internet security suite |
• Shopper.com's most popular security and encryption apps
 | ||||||||||||||
| ||||||||||||||
 
|
|||
|
- Check out what's new
- Introducing the all-new CNET!
- Send feedback
Dell 15" Laptop Deals