CISSP CWE Common Weakness and Enumeration #cissp #cwe #common #weakness #exposure #vulnerability #cve

cissp_cwe.txt

Common Weakness and Enumeration

Program related to CVE (Common Vulnerablity and Exposure)
- Assigns standardized identifiers to software vulnerabilities
- Makes it easier for security researchers, vendors, and IT teams to communicate and prioritize fixes

CWE also catetorizes common coding errors that introduce those vulnerabilities in the first place

CVE + CWE form the connective tissue for a global ecosystem of security tooling and coordination
Will effect:
  - Vulnerability scanners
  - Patch management systems
  - Threat management systems
  - Threat intelligence feeds
  
Vendors use CVEs 
	- To issue advisories
    - Coordinate disclosures
    
Security Teams
	- Track risks
    - Drive remediation
    
CISA and DoD
	- Rely on CVE for threat modelling
    - Defensive planning
    
Risk if Fragmented Landscape
	- Need to gather and consolidate info in a piecemeal fashion
    - With no central repository
    - Risk of total collapse of how known vulnerabilities are assessed, communicated, remediated
    
Examples:
- CVE
	- https://nvd.nist.gov/vuln/detail/cve-2017-0144
- CWE
	- https://cwe.mitre.org/data/definitions/787.html