oasis common security advisory framework (csaf) update cert vendor meeting

OASIS Common Security Advisory Framework (CSAF) Technical Committee UpdateCERT VENDOR MEETINGFEBRUARY 13, 2017

AgendaIntroduction to the OASIS Common Security Advisory Framework (CSAF) Technical Committee.

Transition of the Common Vulnerability Reporting Framework (CVRF) to OASIS.

CVRF version 1.2 Update.

CSAF Roadmap.

Q&A

Introduction to CSAF The OASIS CSAF Technical Committee is chartered to make a major revision to the Common Vulnerability Reporting Framework (CVRF) under a new name for the framework that reflects the primary purpose: a Common Security Advisory Framework (CSAF).

TC deliverables are designed standardize existing practice in structured machine-readable vulnerability-related advisories and further refine those standards over time.

https://www.oasis-open.org/committees/csaf

58 MEMBERS IN LESS THAN 3 MONTHS!

http://www.icasi.org/icasi-transfers-development-of-security-open-standard-to-oasis

https://www.oasis-open.org/news/pr/oasis-advances-standard-for-automated-disclosure-of-cybersecurity-vulnerability-issues

ICASI OASIS

CSAF ROADMAP

6

Nov 2016CSAF Inaugural

Call

CVRF 1.2 contributions to

support CVSSv3.

Launched CSAF Sandbox.

Jan 2017

Mar 2017CVRF 1.2 Release

CSAF (aka CVRF 2.0) work starts:

SWID SupportSupporting Different Formats (JSON, XML,

etc.)Making it

Extensible.Other.

Apr 2017

Major Revision

The goal is to have a major revision of the standard within 18 months of TC creation.

GITHUB

A collaborative environment for the

community to propose and develop

experimental capabilities in the

CSAF specification.

MODERN ENVIRONMENTMajor contributions are expected from TC members, but

everyone is invited to contribute and provide feedback.

OPEN TO EVERYONE

https://github.com/oasis-tcs/csaf

SANDBOX

A collaborative environment for the

community to propose and develop

experimental capabilities in the CSAF specification

CSAF SANDBOXIncluding support

for CVSSv3.

CVRF 1.2 PREVIEW

https://github.com/oasis-tcs/csaf

JIRA

Follow process of action items and

contributions.

OPEN TO EVERYONETracker for action items (tasks) and issues of OASIS

CSAF TC

ISSUE TRACKING

https://issues.oasis-open.org/browse/CSAF

Thank you!

Get Involved!