Pierluigi Paganini September 18, 2020

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has been named a Top-Level Root CVE Numbering Authority (CNA).

The US Cybersecurity and Infrastructure Security Agency (CISA) has been named a Top-Level Root CVE Numbering Authority (CNA), it will be overseeing CNAs in assigning CVE identifiers for vulnerabilities in industrial control systems (ICS) and medical devices.

Each CNA is responsible for issuing CVE identifiers for vulnerabilities that were found in products, while a Top-Level Root CNA manages a group of CNAs belonging to the same domain or community and may assign CVE IDs to vulnerabilities.

Currently, CISA and MITRE are the only Top-Level Root CNAs, there are also 139 CNAs across 24 countries.

CISA will be in charge of ICS and medical device vendors that are CNAs, it will supervise the process to assign CVE identifiers. Other tasks include the implementation of rules and guidelines of the CVE Program, the resolution of disputes, and the recruitment of new CNAs.

The CNAs managed by CISA are Alias Robotics, ABB, CERT@VDE, Johnson Controls, Bosch, Siemens and Gallagher Group.

“As the Top-Level Root for ICS and medical devices, CISA is responsible for ensuring the effective assignment of CVE IDs, implementing the CVE Program rules and guidelines, and managing the CNAs under its care. It’s also responsible for recruitment and onboarding of new CNAs and resolving disputes within its scope.” reads the press release from CISA and Mitre.

“Establishing CISA as a Top-Level Root consolidates the vast expertise required to effectively assign CVE IDs to ICS and medical device vulnerabilities and enables the rapid identification and resolution of issues specific to those environments,”

The work of CISA will enable the rapid identification and resolution of ICS and medical device vulnerabilities.

The US Agency have to promote information sharing to help stakeholders in beign up to date on vulnerabilities and the associated risks.

Recently the OT and IoT security firm Nozomi Networks announced that it has become a Common Vulnerabilities and Exposures (CVE) Numbering Authority (CNA).

Pierluigi Paganini

(SecurityAffairs – hacking, CNA)

[adrotate banner=”5″]

[adrotate banner=”13″]