Security Vulnerabilities
Researchers at the SEI reduce cybersecurity risk by conducting and promoting coordinated vulnerability disclosure; researching and publishing vulnerability discovery tools and techniques; and improving vulnerability data and information systems.
Subscribe to this topic More about this topicBlog Posts
From Concept to Practice: How SSVC Has Evolved to Make Adoption Possible
This post traces the milestones of the Stakeholder Specific Vulnerability Categorization and invites the community to participate, contribute, and benefit from the continued maturation of SSVC.
Read More•By Renae Metcalf, Allen D. Householder, Vijay S. Sarvepalli
In Security Vulnerabilities
What’s New in SSVC: Build, Explore, and Evolve Your Decision Models
Recent updates to the Stakeholder-Specific Vulnerability Categorization (SSVC) framework help different stakeholders to prioritize vulnerabilities according to their distinct risk appetites.
Read More•By Bon Jin Koo, Renae Metcalf, Vijay S. Sarvepalli, Allen D. Householder
In Security Vulnerabilities
The Threat of Deprecated BGP Attributes
This post examines how a small issue with Border Gateway Protocol routing, a deprecated path attribute, can cause a major interruption to Internet traffic.
Read More•By Leigh B. Metcalf, Timur D. Snoke
In Security Vulnerabilities
UEFI: 5 Recommendations for Securing and Restoring Trust
This blog post expands on concerns brought to light from recent UEFI attacks, such as BlackLotus, and highlights 5 recommendations to secure and restore trust in the UEFI ecosystem.
Read More•By Vijay S. Sarvepalli
In Security Vulnerabilities
Vultron: A Protocol for Coordinated Vulnerability Disclosure
This post introduces Vultron, a protocol for multi-party coordinated vulnerability disclosure (MPCVD).
Read More•By Allen D. Householder
In Security Vulnerabilities
UEFI – Terra Firma for Attackers
This blog post focuses on how the vulnerabilities in firmware popularized by the Uniform Extensible Firmware Interface create a lucrative target for high-profile attackers.
Read More•By Vijay S. Sarvepalli
In Security Vulnerabilities
Probably Don’t Rely on EPSS Yet
This post evaluates the pros and cons of the Exploit Prediction Scoring System (EPSS), a data-driven model designed to estimate the probability that software vulnerabilities will be exploited in practice.
Read More•By Jonathan Spring
In Security Vulnerabilities
The Latest Work from the SEI: Coordinated Vulnerability Disclosure, Cybersecurity Research, Cyber Risk and Resilience, and the Importance of Fostering Diversity in Software Engineering
This post highlights the latest work from the SEI in coordinated vulnerability disclosure, cyber risk and resilience management, automation, and the science of cybersecurity.
Read More•By Douglas Schmidt (William & Mary)
In Security Vulnerabilities
Vulnerabilities: Everybody’s Got One!
In this post, Leigh Metcalf describes how she pulled data from the malvuln project to explore recent vulnerabilities in both malware and non-malware to study the differences.
Read More•By Leigh B. Metcalf
In Security Vulnerabilities
CERT/CC Comments on Standards and Guidelines to Enhance Software Supply Chain Security
This SEI Blog post shares insights from the CERT Coordination Center (CERT/CC) on proposed software supply chain security standards and guidelines.
Read More