From Chaos to Consistency: The Role of CSAF in Streamlining Security Advisories

Wunder J, Aurich J, Benenson Z (2024)

Publication Type: Conference contribution, Conference Contribution

Publication year: 2024

Event location: Karlstad University SE

DOI: 10.1145/3688459.3688463

Abstract

Security advisories have become an important part of vulnerability management. They can be used to gather and
distribute valuable information about vulnerabilities. Although there is a predefined broad format for advisories, it is not really standardized. As a result, their content and form vary greatly depending on the vendor. Thus, it is cumbersome and resource-intensive for security analysts to extract the relevant information.
The Common Security Advisory Format (CSAF) aims to bring security advisories into a standardized format which is intended to solve existing problems and to enable automated processing of the advisories. However, a new standard only makes sense if it can benefit users. Hence the questions arise: Do security advisories cause issues in their current state? Which of these issues is CSAF able to resolve? What is the current state of automation?

To investigate these questions, we interviewed three security experts, and then conducted an online survey with 197 participants. The results show that problems exist and can often be traced back to confusing and inconsistent structures and formats. CSAF attempts to solve precisely these problems. However, our results show that CSAF is currently rarely used. Although users perceive automation as necessary to improve the processing of security advisories,
many are at the same time skeptical. One of the main reasons is that systems are not yet designed for automation and a migration would require vast amounts of resources.

Authors with CRIS profile

Julia Wunder Lehrstuhl für Informatik 1 (IT-Sicherheitsinfrastrukturen) Zinaida Benenson Lehrstuhl für Informatik 1 (IT-Sicherheitsinfrastrukturen)

How to cite

APA:

Wunder, J., Aurich, J., & Benenson, Z. (2024). From Chaos to Consistency: The Role of CSAF in Streamlining Security Advisories. In Proceedings of the The 2024 European Symposium on Usable Security. Karlstad University, SE.

MLA:

Wunder, Julia, Janik Aurich, and Zinaida Benenson. "From Chaos to Consistency: The Role of CSAF in Streamlining Security Advisories." Proceedings of the The 2024 European Symposium on Usable Security, Karlstad University 2024.

BibTeX: Download