NIST Improves NVD Backlog
The National Institute of Standards and Technology (NIST), a cornerstone of U.S. cybersecurity strategy, has faced significant delays in processing vulnerabilities in its National Vulnerability Database (NVD). This repository, critical for tracking software and hardware vulnerabilities, has encountered a backlog of unanalyzed Common Vulnerabilities and Exposures (CVEs), raising concerns about its ability to support cybersecurity efforts effectively.
Background of the Backlog
Earlier this year, it became apparent that thousands of vulnerabilities remained unanalyzed due to NIST's resource constraints and the influx of new CVEs. Between February and April, nearly 6,000 CVEs were added to the database, many of which lacked the necessary analysis and enrichment. Enrichment involves adding critical data—such as severity scores, affected products, and exploit details—that security professionals rely on to mitigate risks.
Despite efforts to address the issue, including contracting third-party support in May, NIST recently acknowledged that its goal of resolving the backlog by the end of 2024 was overly optimistic. The backlog of vulnerabilities remains substantial, although all actively exploited vulnerabilities (Known Exploited Vulnerabilities or KEVs) have now been processed.
Challenges with ADP Data Integration
A significant hurdle has been the format of data submitted by Authorized Data Providers (ADPs), such as the Cybersecurity and Infrastructure Security Agency (CISA). These submissions often require manual processing due to compatibility issues with NIST's current systems. As of now, CISA is the only recognized ADP, adding context and risk-related information to CVE records.
To address these challenges, NIST is developing new systems to streamline the processing of incoming ADP data, which it hopes will enhance the efficiency of future vulnerability analysis.
Current Progress and Future Outlook
NIST reports that it now has a "full team of analysts" in place, ensuring that all new CVEs are processed promptly upon submission. The processing of KEVs from the backlog has been completed, marking a significant milestone. However, broader progress remains slow, with 72.4% of CVEs still lacking full analysis as of September.
This delay has led to frustration among cybersecurity professionals and researchers. Earlier this year, a group of experts petitioned Congress to allocate more resources to the NVD, emphasizing its importance as critical infrastructure for global cybersecurity efforts. Notably, of the 12,720 CVEs added to the database since February, nearly 11,885 lacked essential enrichment.
The Critical Role of the NVD
The NVD is not just a U.S. resource; it is widely used by organizations worldwide. Its entries provide essential insights into vulnerabilities, enabling security teams to assess risks and protect systems against evolving threats. The backlog, therefore, has implications far beyond U.S. borders, potentially leaving systems vulnerable due to incomplete data.
As Rob Joyce, former cybersecurity director for the National Security Agency, noted, this backlog represents a "significant risk" to the cybersecurity industry, hindering its ability to understand and defend against emerging attack vectors.
Moving Forward
While progress has been made, NIST's struggles highlight the need for continued investment in the NVD. The agency's efforts to modernize its systems and improve the efficiency of ADP data integration are crucial steps toward resolving the backlog. However, with no clear timeline for when the backlog will be fully cleared, the cybersecurity community must remain vigilant and proactive in addressing vulnerabilities, even in the absence of complete NVD data.
The NVD remains operational, and updates on its status and progress can be found on its official website. NIST has committed to providing regular updates as it works to restore the database to its full capacity.
For organizations relying on the NVD, the backlog underscores the importance of supplementing vulnerability management practices with additional threat intelligence sources to maintain robust cybersecurity defenses.
Source: security.nl
