STATE REGULATION OF NAMING AND SOFTWARE IDENTIFICATION IN VULNERABILITY MANAGEMENT PROCESSES

Abstract

IT asset management is the foundation for building an effective vulnerability management process.
Without an understanding of the IT assets under control, it is technically impossible to start building a
vulnerability management process. With an existing IT asset management process in place, one of the
tasks that is essential to vulnerability management is to uniquely name software as an asset. This unambiguous
naming allows the software and its vulnerabilities to be identified without actively scanning IT
infrastructure nodes, but only by interacting with the IT asset management system. Technically, this approach
can be called “passive vulnerability detection,” but it is extremely labor-intensive to implement
using existing naming systems. In order to make the possibility of passive detection more realistic, the
authors propose to create a common foundation by forming a conceptual scheme and then creating a system
of standardized naming and identification of software, the regulation of which will be centralized at
the state level. As part of the review of existing software naming systems, attention is paid to CPE problems
both on the part of on-site specialists, namely obtaining CPE identifiers and translating software
information into a CPE identifier, and on the part of a vulnerability data aggregator, namely obtaining
vulnerability information via a CPE identifier. The problems of CPE application, as well as the problems
of interaction with vulnerability data aggregators from unfriendly countries, discovered in the course of
the research form the prerequisites for the formation of a national system for state regulation of software
naming and identification, which will eliminate the problems of existing software naming systems. In conclusion,
advantages of the national system of software naming and identification are given in case of its
creation and use in real conditions by all participants of the vulnerability management process