CWE_Industry_Question_and_Response_2017.pdf

Can government please provide a list of the anticipated “CWE (Common Weakness Enumeration), CVE (Common Vulnerabilities & Exposures), OWASP (Open Web Application Security Project) provided by the Government” to assess the potential cost impacts associated with migrating to complete compliance to CWE, CVE, and OWASP?

1. Yes, we have added some documentation to the bidder’s library specifically the Common Weakness Enumeration (CWE) Version 2.10 dated 19 Jan 2017 developed by the MITRE Corporation in support of the US Department of Homeland Security.

Additionally, the link to the Common Weakness Enumeration website is:

https://cwe.mitre.org/data/ This website contains the CWE/SANS Institute Top 25 for 2011, OWASP Top Ten for 2013 and also specific secure coding standards for specific software to include Java and C++. Both of these items have also been added to the bidder’s library for reference.

2. Common Vulnerabilities and Exposures (CVE®) is a dictionary of common names (i.e., CVE Identifiers) for publicly known cybersecurity vulnerabilities. CVE's common identifiers make it easier to share data across separate network security databases and tools, and provide a baseline for evaluating the coverage of an organization’s security tools. If a report from one of your security tools incorporates CVE Identifiers, you may then quickly and accurately access fix information in one or more separate CVE-compatible databases to remediate the problem.

CVE was launched in 1999 when most information security tools used their own databases with their own names for security vulnerabilities. At that time there was no significant variation among products and no easy way to determine when the different databases were referring to the same problem. The consequences were potential gaps in security coverage and no effective interoperability among the disparate databases and tools. In addition, each tool vendor used different metrics to state the number of vulnerabilities or exposures they detected, which meant there was no standardized basis for evaluation among the tools. CVE’s common, standardized identifiers provided the solution to these problems. CVE is now the industry standard for vulnerability and exposure names.

To have access to the dictionary for Common Vulnerabilities & Exposures (CVE) you can go to the website: https://cve.mitre.org/ https://cwe.mitre.org/data/ https://cve.mitre.org/