Another Step Forward Towards Responsible Vulnerability Disclosure in Europe

ENISA Expands Support to EU CSIRTs for Coordinated Vulnerability Disclosure

New Authorization as a Common Vulnerabilities and Exposures (CVE) Numbering Authority

Published on June 12, 2024

The European Union Agency for Cybersecurity (ENISA) has taken a significant step in enhancing cybersecurity resilience across the EU single market. ENISA has expanded its support to EU Computer Security Incident Response Teams (CSIRTs) by adopting a crucial role in Coordinated Vulnerability Disclosure (CVD) and has been authorized as a Common Vulnerabilities and Exposures (CVE) Numbering Authority (CNA).

Enhancing Coordinated Vulnerability Disclosure

Under its mandate to foster cybersecurity resilience, ENISA has been actively promoting CVD practices and supporting EU CSIRTs in developing national-level CVD policies. The agency has continuously provided guidelines, recommendations, and analyses to assist Member States in implementing these policies. This proactive approach has led to the successful adoption of CVD policies in several EU Member States.

Now, ENISA is further extending its support by offering a vulnerability registry service. As a CVE Numbering Authority, ENISA is authorized to assign CVE Identifiers (CVE IDs) and publish CVE Records for vulnerabilities discovered by or reported to EU CSIRTs. This new role aligns with ENISA’s mission to enhance the coordination and management of reported vulnerabilities within the EU CSIRTs network.

A New Role in Vulnerability Management

Hans de Vries, Chief Cybersecurity and Operating Officer (COO) at ENISA, emphasized the importance of this development: “We all rely on software and services in our daily lives. However, software can have vulnerabilities that disrupt use or open doors for potential misuse. Recognizing and addressing these vulnerabilities promptly is crucial to ensuring our digital security. ENISA is contributing to enhance EU CSIRTs' coordination on reported vulnerabilities and assessing their potential impact via the EU CSIRTs network. Collectively, and with ENISA now authorized as a Common Vulnerabilities and Exposures (CVE) Numbering Authority, it can be done more effectively."

Developing a European Vulnerability Database

In line with the NIS2 directive, ENISA is also developing and maintaining a European Vulnerability Database (EUVD). This database will provide transparent access to enriched vulnerability information from various sources, including CSIRTs, vendors, and existing databases. The EUVD aims to support organizations in efficiently triaging and prioritizing vulnerability management efforts. It introduces automation by supporting the Common Security Advisory Framework (CSAF), a standard for machine-readable security advisories. By using CSAF, vendors can reduce the time required for enterprises to understand the impact of vulnerabilities and drive timely remediation.

Legislative Support for Vulnerability Disclosure

The Cyber Resilience Act (CRA) is another legislative development that addresses vulnerability disclosure. The CRA includes provisions for vulnerability handling requirements, further supporting the EU's commitment to robust cybersecurity practices.

Understanding Coordinated Vulnerability Disclosure (CVD)

CVD is a model designed to limit the threat of vulnerability exploitation by ensuring that vulnerabilities are disclosed to the public only after the responsible parties have had adequate time to develop fixes, patches, or mitigation measures. This approach balances the need for transparency with the necessity of providing security teams sufficient time to address vulnerabilities.

The CVE Programme and Numbering Authorities

The CVE programme's mission is to identify, define, and catalogue publicly disclosed cybersecurity vulnerabilities. Each vulnerability in the catalogue is assigned a unique CVE Record. Organizations worldwide partner with the CVE Programme to publish these records, providing consistent descriptions of vulnerabilities to facilitate effective communication and coordination among cybersecurity professionals.

CVE Numbering Authorities (CNAs) are responsible for assigning CVE IDs and creating and publishing the associated CVE Records. With its new role as a CNA, ENISA will assign CVE IDs and publish records for vulnerabilities discovered by or reported to EU CSIRTs, enhancing the coordination and management of cybersecurity threats across Europe.

The Common Security Advisory Framework (CSAF)

CSAF is a standard for publishing machine-readable security advisories. It simplifies the triage and remediation processes for asset owners by standardizing the format of vulnerability advisory information. Vendors using CSAF can help enterprises quickly understand the impact of vulnerabilities and implement timely remediation measures.