[179979] in North American Network Operators' Group
No subject found in mail header
daemon@ATHENA.MIT.EDU (Ryan Shea via NANOG)
Tue May 19 11:53:20 2015
To: nanog list <nanog@nanog.org>
From: Ryan Shea via NANOG <nanog@nanog.org>
Reply-To: Ryan Shea <ryanshea@google.com>
Errors-To: nanog-bounces@nanog.org
Date: Tue, 19 May 2015 15:53:19 +0000 (UTC)
--===============8834458866002210825==
Content-Type: text/plain; charset="us-ascii"
MIME-Version: 1.0
Content-Transfer-Encoding: 7bit
Content-Disposition: inline
This post was from a subscriber whose From: address domain has a DMARC
policy of reject or quarantine. The NANOG mailing list has
automatically wrapped this message to prevent other subscribers mail
systems from rejecting it.
--===============8834458866002210825==
Content-Type: message/rfc822
MIME-Version: 1.0
Content-Disposition: inline
Return-Path: <ryanshea@google.com>
X-Original-To: nanog@nanog.org
Delivered-To: nanog@nanog.org
Received: from mail-vn0-x22b.google.com (mail-vn0-x22b.google.com [IPv6:2607:f8b0:400c:c0f::22b])
by mail.nanog.org (Postfix) with ESMTPS id 4198F2C0129
for <nanog@nanog.org>; Tue, 19 May 2015 15:53:18 +0000 (UTC)
Received: by vnbf129 with SMTP id f129so1421804vnb.10
for <nanog@nanog.org>; Tue, 19 May 2015 08:53:17 -0700 (PDT)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;
d=google.com; s=20120113;
h=mime-version:from:date:message-id:subject:to:content-type;
bh=6gbqyrM0SPPnyrplddq+M80OWN8i8yB4nQWw2GVFY/I=;
b=Qm3VOqxUPlbR11CjrfG6Wjx7BnTOcZ1yXCdodE53WB5jft+uPc8VvpcJUb9dHrq+W6
0gBQqSVKxY6TokPDpmrs3pDp5bHDJ8k76qSQGnxXkLUVKQ4+6KRV8S5goSgMcEoY9FPB
dN54HiKuzpu+njqXl/ra9ZEQrTck6exvjxBQo0JLT9x7CXaM5Mc5dzuzeLYWTEGW4zby
TuY7Yr6HHdgMih/3wX7pDylqZCiQAkSm6IkF605le1KnUwYuxEEE8+Rn93zlZaoj9jzE
qSk+7Vnsf9qtsxseLcpHvhVmBP0z/jLgIfXNcFF8PqZjEmygtJkCm/d+KM1JrWgo3luq
tk8A==
X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;
d=1e100.net; s=20130820;
h=x-gm-message-state:mime-version:from:date:message-id:subject:to
:content-type;
bh=6gbqyrM0SPPnyrplddq+M80OWN8i8yB4nQWw2GVFY/I=;
b=jUREfHPuL25itexBnSaPfWP2fiTq8h2aCPznem5/LSB+U+ONF0bWWfjTBYQBgvj24y
cUQ7ezYbcIFLTF75l7GgeqMTf76rftBq74AdbFHEBqQRGX2WQ+UlvmgqWB2P6n+g8w1y
sizc1XqJtwNhAOr/sTCgopaRzueWZoI74vr8ZWmUMnrNpS/3ACS6PttlvwkuLCBkhiWv
BxeruFlrNJXm45Ohf0Jdt6v9fOPKrDTrcUzk4CWGxD7d5PFtVkMgACV4I3Mu1vWdzp6c
hYQfrGM57KRytHmS+JxvRvqGLN8R2x342hl5RW5s1Vdzi9mKjm/lDkCH4odC/Qk8IoV0
udCw==
X-Gm-Message-State: ALoCoQnni+nQ7LIY0fGyAyoN6ILC4qUbQXOgLAPS3PJjO7zTKqwrYd2Y++oA+xxw5Y4COe3BQTtA
X-Received: by 10.52.71.203 with SMTP id x11mr28657594vdu.48.1432050797695;
Tue, 19 May 2015 08:53:17 -0700 (PDT)
MIME-Version: 1.0
From: Ryan Shea <ryanshea@google.com>
Date: Tue, 19 May 2015 15:53:15 +0000
Message-ID: <CAGWL9Q3jbooGK3M5sdE25kOAGV8YuABdxBQL+kBdOgiJTvmXTg@mail.gmail.com>
Subject: Unified Security Vulnerability Management
To: nanog list <nanog@nanog.org>
Content-Type: text/plain; charset=UTF-8
X-Content-Filtered-By: Mailman/MimeDel 2.1.20
Manually setting up and parsing email notifications for security
vulnerabilities for all vendors is mighty annoying. It looks like the ICASI
CVRF <http://www.icasi.org/cvrf> Working Group thought the same thing back
in 2011 when they came up with this handy XML schema. I had not known of
this until yesterday and noticed that Cisco does a good job
<http://tools.cisco.com/security/center/cvrfListing.x> posting their
vulnerabilities in CVRF. Word on the streets is that Juniper
<https://twitter.com/junipersirt/status/70627418737610752> was at least
partially involved in CVRF as well. Brocade may have looked into it as well.
This does not seem like a difficult thing for vendors to do, but the
missing piece may be customer interest. I am hoping to drum up some
interest here -- maybe a few support requests would entice them to hand
this off to an intern and we could collectively do better at managing
vendor notifications. A tool <https://github.com/mschiffm/cvrfparse> to
parse CVRF is already floating about as well (mschiffm).
--===============8834458866002210825==--
