CISA Named Top-Level Root CVE Numbering Authority (CNA)

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has been named a Top-Level Root CVE Numbering Authority (CNA).

The US Cybersecurity and Infrastructure Security Agency (CISA) has been named a Top-Level Root CVE Numbering Authority (CNA), it will be overseeing CNAs in assigning CVE identifiers for vulnerabilities in industrial control systems (ICS) and medical devices.

Each CNA is responsible for issuing CVE identifiers for vulnerabilities that were found in products, while a Top-Level Root CNA manages a group of CNAs belonging to the same domain or community and may assign CVE IDs to vulnerabilities.

Currently, CISA and MITRE are the only Top-Level Root CNAs, there are also 139 CNAs across 24 countries.

CISA will be in charge of ICS and medical device vendors that are CNAs, it will supervise the process to assign CVE identifiers. Other tasks include the implementation of rules and guidelines of the CVE Program, the resolution of disputes, and the recruitment of new CNAs.

The CNAs managed by CISA are Alias Robotics, ABB, CERT@VDE, Johnson Controls, Bosch, Siemens and Gallagher Group.

“As the Top-Level Root for ICS and medical devices, CISA is responsible for ensuring the effective assignment of CVE IDs, implementing the CVE Program rules and guidelines, and managing the CNAs under its care. It’s also responsible for recruitment and onboarding of new CNAs and resolving disputes within its scope.” reads the press release from CISA and Mitre.

“Establishing CISA as a Top-Level Root consolidates the vast expertise required to effectively assign CVE IDs to ICS and medical device vulnerabilities and enables the rapid identification and resolution of issues specific to those environments,”

The work of CISA will enable the rapid identification and resolution of ICS and medical device vulnerabilities.

The US Agency have to promote information sharing to help stakeholders in beign up to date on vulnerabilities and the associated risks.

Recently the OT and IoT security firm Nozomi Networks announced that it has become a Common Vulnerabilities and Exposures (CVE) Numbering Authority (CNA).

[adrotate banner=”9″]

[adrotate banner=”12″]

Pierluigi Paganini

(SecurityAffairs – hacking, CNA)

[adrotate banner=”5″]

[adrotate banner=”13″]

Pierluigi Paganini

Pierluigi Paganini is member of the ENISA (European Union Agency for Network and Information Security) Threat Landscape Stakeholder Group and Cyber G7 Group, he is also a Security Evangelist, Security Analyst and Freelance Writer. Editor-in-Chief at "Cyber Defense Magazine", Pierluigi is a cyber security expert with over 20 years experience in the field, he is Certified Ethical Hacker at EC Council in London. The passion for writing and a strong belief that security is founded on sharing and awareness led Pierluigi to find the security blog "Security Affairs" recently named a Top National Security Resource for US. Pierluigi is a member of the "The Hacker News" team and he is a writer for some major publications in the field such as Cyber War Zone, ICTTF, Infosec Island, Infosec Institute, The Hacker News Magazine and for many other Security magazines. Author of the Books "The Deep Dark Web" and “Digital Virtual Currency and Bitcoin”.