CVE Automation: Why Relying Solely on NVD Isn't Enough

The Importance of Using the Right Sources for Vulnerability Management Automation

Detecting and tracking vulnerabilities in your environment is a critical part of managing security risks. Understanding your historical vulnerability exposure allows you to spot trends, strengthen weaknesses, and prove due diligence. However, with new vulnerabilities disclosed daily, keeping up with sources beyond the National Vulnerability Database (NVD) can be challenging.

While the NVD is the most comprehensive public database of Common Vulnerabilities and Exposures (CVEs), disclosures often first appear through vendor channels. Microsoft, Red Hat, Ubuntu, VMware and others release security advisories, errata and bulletins that may precede or augment NVD. These sometimes provide additional technical details on affected packages and configs, as well as possible workarounds.

Aggregating these disparate data sources manually is impractical as it can be more prone to a human error, needless to say it is considerably time consuming and therefore unsustainable in a long term. This busywork distracts security teams from the job of actually fixing critical vulnerabilities. To make matters worse, even the vendor’s data sources tend to be imperfect and require expert understanding to utilize properly. Hence, it is key to automate the collection and correlation process.

Supposing you develop such a complex automation, you will likely get overwhelmed by hundreds or thousands of findings to go through and prioritize. While CVEs have a Common Vulnerability Scoring System (CVSS) score attached, you will typically find only the “base score” describing the vulnerability itself. In terms of prioritization, it is often more important to distinguish between potential vulnerabilities and exploited ones. Next step: integrate a database of known exploits, most notably CISA KEV, into the automation process.

Naturally, that can be an overwhelming amount of work, especially for larger environments. Vulnerability management and automation tools already incorporate NVD along with vendor advisories, errata and bulletins. They know what packages to evaluate and which package versions contain vulnerabilities across various operating systems and platforms. That way, these tools offer an always up-to-date view of your exposure.

Runecast stands out by keeping historical views of the analysis findings in its database –  just select a date. This enables both current and trend analysis over time, with one-click comparison, and provides valuable data for security audit purposes and vulnerability management automation. On top of that, you immediately know which CVEs to address with highest priority thanks to an integration with CISA KEV or Exploit DB.

In conclusion, leveraging diverse vulnerability data sources provides the most comprehensive coverage and makes prioritization more effective. However, attempting to implement such automation on your own may prove impractical, time consuming and difficult to maintain in long term. Luckily, teams of seasoned experts, like those at Runecast, have already developed automated solutions to manage these tasks, empowering security teams to concentrate on more impactful endeavors.