MITRE funding still in up in the air, say experts – Source: www.csoonline.com

“The funding was cut randomly and without thought because lots of things are being cut,” he said in an interview. Then, “someone noticed that this is actually important, and re-instated funding for some time. But there’s no confidence that the funding will continue. So I think the community needs to figure out how to do this without the help of the United States government … It will be interesting to figure out what they [MITRE] will do: Will they self-fund something? Will the EU step in? Who knows? I don’t know who else would do it.”

The MITRE program, he said, “is the kind of good that helps the US and the world.”

‘Too important not to be funded’

But, he added, “This is too important to go back to the old way where we didn’t have this [CVE database]. It’s a consolidated way of writing out and talking about vulnerabilities, which is really important.”

Asked whether leaving a renewal decision to the last minute was just a mistake of a new administration focused on other things, Schneier said he suspects it was decided that “this is within the blast radius” of cost cutting. Someone, he said, decided, “’We’re cutting everything, this is part of everything.’ That’s happened a bunch of times. Like [the way] they fired nuclear safety engineers, and then they said, ‘Wait, we might need those,’ so they tried to get them back. My guess is that’s what happened.”

Schneier couldn’t say why the contract was only extended for 11 months. “I don’t think there’s a signal in that at all.”

MITRE’s CVE program is the de facto standard for identifying vulnerabilities and guiding defenders’ vulnerability management programs. It provides foundational data to cybersecurity products across vulnerability management, cyber threat intelligence, security information, event management, and endpoint detection and response.

“The CISA funding extension will hopefully allow for an orderly transition,” Johannes Ullrich, dean of research at the SANS Institute, said in an email. “CVE numbers are critical to properly catalog and respond to new vulnerabilities.”  

MITRE operating the CVE system under a US government contract hasn’t been without controversy before, he added. Some members of the CVE board suggested setting up a new entity, The CVE Foundation, to allow for more diverse funding from international stakeholders.

That’s one possible solution, Schneier said. “Something has to be done. The US is not a reliable partner here.”

Echoing Schneier’s concerns, on Wednesday, the CVE board announced the establishment of that entity. The new CVE Foundation will focus solely on continuing the mission of delivering high-quality vulnerability identification and maintaining the integrity and availability of CVE data for defenders worldwide, organizers said. The announcement didn’t detail how it would be funded.

‘Shouldn’t be begging’

“MITRE leaders have been begging for more private funding for years,” said Roger Grimes, data driven defense evangelist at KnowBe4, in an email.

“This isn’t a type of program where the program leaders should be begging for funding. It should be fully funded, correctly resourced, and able to do a superb job for its mission. It’s an incredibly valuable resource and the entire cybersecurity community wants to know if it will be given the attention and funding it has always needed for the seriousness of its mission. Great to hear it’s being extended, but the devil is in the details.”

“Now,” he said, “the question is — is it being funded at the same level, less, or even better? Because the program has always had a ton of deficiencies for years that the community has been hoping could be improved. That program has been existing on a shoestring budget for years, hanging on by a thread, ready to collapse in usefulness at any minute.

“I hope we can all go to sleep better at night knowing that it is not only getting extended, but will actually be improved and become the service it should have always been…so that the program’s leaders can do less begging for funding and more managing and improving the program.”