Subject: [scap_interest] Software Vulnerability Mitigation Automation - IVIL v1.0

From: Jerome Athias <[email-masked]>
Date: Thu, 16 Feb 2012 01:11:53 +0000

As mentioned in the U.S. "INTERNATIONAL STRATEGY FOR CYBERSPACE"[1] 
document,
we need "interoperable and secure technical standards, determined by 
technical experts".

I would like to introduce my vision of "Software Vulnerability 
Mitigation Automation"
via IVIL v1.0 via a (incomplete) Conceptual Map.

Requirements: ~15 minutes of your time, a headset and the Boléro

https://corevidence.com/research/vulnerability_interoperability_ivil_v1.jpg

(I extracted some links, please see below)

i = x2ivil + ivil2x
where "i" is interoperability and "x" a software (vulnerability 
scanner,... + waf, virtual patching system, ...)

What do you think?

Thank you.
Best regards,

Jerome Athias - NETpeas
VP, Director of Software Engineer
Palo Alto - Paris - Casablanca
http://www.netpeas.com

"The computer security is an art form. It's the ultimate martial art."

[1]   
  http://www.whitehouse.gov/blog/2011/05/16/launching-us-international-strategy-cyberspace
IVIL-XML   
  http://www.cupfighter.net/index.php/2010/10/ivil-an-xml-schema-to-exchange-vulnerability-information/
ThreadFix    http://code.google.com/p/threadfix/

---

From: Luis Nunez <[email-masked]>
Date: Fri, 17 Feb 2012 11:37:55 -0500

I certainly see this theme of "information sharing" and"standards" emanating from US politics. I am sure similar issues are being debated else where globally. 

Thanks for providing the snap shot of the intricacies of security information.  I wanted to emphasis some of the problems we are trying solve here. We are trying to solve the problem of communicating and connecting the dots all in a cooperative and cohesive way.  So it starts with standardizing the Security Automation specifications.

I look forward to seeing more of the "vulnerability interoperability" proposal.

Thanks.

-ln

On Feb 15, 2012, at 8:11 PM, Jerome Athias wrote:

> As mentioned in the U.S. "INTERNATIONAL STRATEGY FOR CYBERSPACE"[1] document,
> we need "interoperable and secure technical standards, determined by technical experts".
> 
> I would like to introduce my vision of "Software Vulnerability Mitigation Automation"
> where "i" is interoperability and "x" a software (vulnerability scanner,... + waf, virtual patching system, ...)
> 
> What do you think?
> 
> Thank you.
> Best regards,
> 
> Jerome Athias - NETpeas
> [1]    http://www.whitehouse.gov/blog/2011/05/16/launching-us-international-strategy-cyberspace
> IVIL-XML    http://www.cupfighter.net/index.php/2010/10/ivil-an-xml-schema-to-exchange-vulnerability-information/
> _______________________________________________
> scap_interest mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/scap_interest