Cloud & Telecom Security

Oct.18 2009(Beijing time), China CCTV news reported the release of national vulnerability database of China.

Along with the upsoaring of the Internet applications, the vulnerability number is also in a sharp growth. So the update and automation of vulnerability information is becoming more and more critical for the whole information ssytems. Vulnerability Database is used to research, collect, release, automate the lifecycle of vulnerability management, which is regarded the core of the related activities. Although there have been a series of open source vulnerability database(e.g. OSVDB, etc.), commercial maintained vulnerailibity database(e.g. CERT CVE, Bugtraq, NSFocus VDB, etc.), it’s still regarded very essential to setup one authoritive database for the industry, particularly for government and research organizations.

The China national vulnerability database(CNVDB) is built and operated by CNITSEC, which is famous for its evaluation, cerfication of information security products and services at China. The below is a brief self-intro from its official website:

Conducts vulnerability analysts
Enables evaluation of security risk
Provides IT security evaluation and testing services
Provides evaluation services for information security professionals
Delivers IT security consulting, engineering supervision and R&D services

According to the news report, CNVDB has 40,000+ vulnerability entries, 70,000+ of patch and fix information entries, 10,000,000+ of cyber hacking incidents and victim entries.

China is not the first country to build and operate one national level  VDB. Actually, USA has its VDB online for a few years.

“NVD is the U.S. government repository of standards based vulnerability management data. This data enables automation of vulnerability management, security measurement, and compliance (e.g. FISMA). “

The above is the mission statement of National Vulnerability Database of U.S. The data of NVD till Oct.16 is:

NVD contains:
39269     CVE Vulnerabilities
128    Checklists
182     US-CERT Alerts
2347     US-CERT Vuln Notes
2517    OVAL Queries
Last updated:  10/16/09
CVE Publication rate: 12 vulnerabilities / day

The data of OSVDB is as the below (as is Oct.19 2009):

The database currently covers 58,097 vulnerabilities, spanning 25,683 products, from 4,676 researchers.

Be Sociable, Share!

•