REST API Access to NVD at NIST

NVD - National Vulnerability Database

NIST - National Institute of Standards and Technology

The NVD is the U.S. government repository of standards based vulnerability management data represented using the Security Content Automation Protocol (SCAP). This data enables automation of vulnerability management, security measurement, and compliance. The NVD includes databases of security checklist references, security-related software flaws, misconfigurations, product names, and impact metrics.

There is a vulnerability API access to query NVD directly. It is available at Vulnerability API documentation. An example to retrieve CVE information in JSON format can be access at:

https://services.nvd.nist.gov/rest/json/cves/2.0?cveId=CVE-2022-1388

At the vulnerability metrics page, NVD is providing 2 CVSS calculators: CVSS_v2 and CVSS_v3.1 calculator, for product integration. For examples:

https://nvd.nist.gov/vuln-metrics/cvss/v2-calculator?name=CVE-2022-1388

https://nvd.nist.gov/vuln-metrics/cvss/v3-calculator?name=CVE-2022-1388

Links:

• https://nvd.nist.gov/
• https://nvd.nist.gov/developers/vulnerabilities
• https://nvd.nist.gov/Vulnerability-Metrics/Calculator-Product-Integration

Retirement of CVSS v2 and XML Feed

As of July 13th, 2022, NVD will stop generating Vector Strings or Severity Score for CVSS v2. This means the existing CVSS v2 information will remain in the database but the NVD will no longer actively populate CVSS v2 for new CVEs.

This change comes as CISA policies that rely on NVD data fully transition away from CVSS v2. 

Here are the historical of the CVSS version and the timeline.

Timeline	CVSS v2	CVSS v3	CVSS v4
2007 - 2014	Yes	No	-
2015 - 2022	Yes	Yes	-
2022 - now	No	Yes	-
2024	No	Yes	(tentatively)

 

As of July 22nd, 2022, XML URLs will be removed from the data feeds page (according to phase 2 of XML retirement plan). 

However, NVD will continue to update the feed and host the URLs. And any automated process that downloads the XML feeds should not be impacted.

SMS 2 Factor authentication

Why is SMS 2 Factor authentication not secure?

Firstly, I would say that there is nothing wrong 2FA; it is wrong when we use 2FA with SMS, and this is a typical kind of "mis-configuration".

Second, 2FA via SMS is easy to setup and requires no download of any app or reader except a mobile phone with SIM card.

Anyway, NIST, USA has recommended that 1-time SMS is no longer secure to.

SMS Vulnerabilities

• Intercepting SMS codes
• Spoof SMS verification
• Phone account hijacking

Alternative secure authentication options

1. OTP method - one-time password
2. FIDO U2F (leading option for 2FA) - similar to smart card wit PKI.
   
3. Push Authentication - faster than typing password
   
4. Multi-Factor Authentication (MFA) - best solution

Links:

• Why is SMS 2 Factor authentication not secure?
  

Getting Started ith OpenSCAP

The Security Content Automation Protocol (SCAP) enables automated vulnerability scanning , measurement and policy compliance evaluation of systems based on a method of using specific standards (managed by NIST). 

It was created to provide a standardized approach to maintain the security of enterprise systems, such as automatically verifying the presence of patches, checking system security configuration settings, and examining systems for signs of compromise.

OpenSCAP is a free implementation of SCAP. The SCAP Security Guide along with SCAP components can be utilized in order to automate continuous security management within an organization.

Almost every OS vendor, including RedHat, Ubuntu, and Oracle, supports SCAP to get an overview of which security vulnerabilities are on your system using OpenSCAP. And every OS vendor will provide OVAL, Open Vulnerability and Assessment Language XML file which cab be used in combination with OpenSCAP to get a quick overview of a system.

The following is a step by step guide of how to produce a report in an Ubuntu OS based on Ubuntu OVAL.

Download and install OpenCAP for Ubuntu:

$ sudo apt install libopenscap8

Verify the oscap tool

$ oscap -V

Download Ubuntu OVAL:

$ wget https://security-metadata.canonical.com/oval/com.ubuntu.$(lsb_release -cs).usn.oval.xml.bz2

Uncompress the data:

$ bunzip2 com.ubuntu.$(lsb_release -cs).usn.oval.xml.bz2

Check the integrity of the OVAL XML:

$ oscap info com.ubuntu.$(lsb_release -cs).usn.oval.xml

Use OpenSCAP to evaluate OVAL against localhost and generate an HTML report:

$ oscap oval eval --report report.html com.ubuntu.$(lsb_release -cs).usn.oval.xml

Lastly, open the report.html with any borwser.

 

report.html

Links:

• How we use Ubuntu OVAL
  

Analysis of NIST NVD Vulnerabilities in 2020

Just finished reading the full analysis report from Redscan. Although more vulnerabilities are on rise, there are still more positive signs based on the analysis. Here're some key takeaways:

• Total of 18,103 vulnerabilities were disclosed in 2020 
• 57% 10,342) of vulnerabilities in 2020 were classified as being ‘critical’ or ‘high’ severity
• Vulnerabilities which require no user interaction to exploit are also increasing, representing 68% of all CVEs recorded in 2020
• Vulnerabilities which require no user privileges to exploit are on the decline (from 71% in 2016 to 58% in 2020)

Threat Intelligence data for Vulnerability Management:

1. Many CVEs are never or rarely exploited in the real world because they are too complex or require attackers to have access to high level privileges.
2. Identifying which vulnerabilities to prioritise is a perennial challenge for Cybersecurity, especially as the number of CVEs only continues to grow.
   

 

CVEs recorded by NIST NVD (1995-2020)

Links:

• Redscan analysis of NIST NVD reveals record number of critical and high severity vulnerabilities in 2020
  
• Download the full report. 
• Measuring risk: Organizations urged to choose defense-in-depth over CVE whack-a-mole