NIST Deprioritizes Pre-2018 CVEs Amid Backlog and New Threats

Article Highlights
Off On

The US National Institute of Standards and Technology (NIST) recently made a significant decision affecting the cybersecurity landscape by marking all Common Vulnerabilities and Exposures (CVEs) published before January 1, 2018, as “Deferred” in the National Vulnerability Database (NVD). This move impacts over 20,000 entries and potentially up to 100,000, signaling that these CVEs will no longer be prioritized for further enrichment data updates unless they appear in the Cybersecurity and Infrastructure Security Agency’s (CISA) Known Exploited Vulnerabilities (KEV) catalog. NIST’s decision comes in response to an ongoing struggle with a growing backlog in processing vulnerability data, exacerbated by a 32% surge in submissions in the past year.

An Overwhelming Backlog and Strategic Reprioritization

NIST’s challenges in processing and enriching the vast amount of incoming data have delayed its goal of clearing the backlog by the end of fiscal year 2024. In response, NIST is developing new systems to handle these issues more efficiently. Industry experts consider this move practical given the complexities of managing vulnerabilities at scale. Ken Dunham from Qualys describes it as an evolution in the face of changing cyber threats. Meanwhile, Jason Soroko from Sectigo interprets this as a strategic reprioritization, with resources redirected towards addressing emerging threats, assuming that legacy issues have been mitigated through routine patch management practices. The responsibility for managing deferred CVEs now shifts more heavily onto organizations. For security teams, this means identifying and monitoring legacy systems, prioritizing the patching of deferred vulnerabilities, and hardening or segmenting outdated infrastructure. Using real-time threat intelligence to detect attempts at exploiting these vulnerabilities becomes crucial. This shift highlights a broader trend where organizations must adopt proactive risk management strategies due to the increasing volume of CVEs and limited resources available to handle them.

Embracing Advanced Technology for Improved Efficiency

In addressing its backlog, NIST is also exploring the potential use of artificial intelligence (AI) and machine learning to streamline the processing of vulnerability data. This move reflects an ongoing trend in the cybersecurity industry toward leveraging advanced technologies for more efficient management of vulnerabilities. By incorporating AI and machine learning, NIST aims to ensure that both older and newer vulnerabilities receive appropriate attention within the constraints of available resources. This nuanced approach to cybersecurity management underscores the need for a balance between addressing legacy vulnerabilities and staying ahead of emerging threats. Organizations are encouraged to adopt similar strategies, using technology to enhance their cybersecurity efforts and ensure comprehensive coverage of potential vulnerabilities. This shift in focus not only addresses immediate backlog issues but also sets the stage for more sustainable and scalable vulnerability management practices in the future.

New Paradigm for Cybersecurity Management

The US National Institute of Standards and Technology (NIST) has recently made a crucial decision that impacts the cybersecurity domain by designating all Common Vulnerabilities and Exposures (CVEs) published before January 1, 2018, as “Deferred” in the National Vulnerability Database (NVD). This adjustment affects over 20,000 entries and potentially up to 100,000, indicating that these CVEs will no longer receive prioritized updates for enrichment data unless they are listed in the Cybersecurity and Infrastructure Security Agency’s (CISA) Known Exploited Vulnerabilities (KEV) catalog. NIST’s decision is a response to an ongoing challenge with a growing accumulation of vulnerability data, which has been aggravated by a 32% increase in submissions over the past year. This strategic shift aims to address the backlog more effectively and allocate resources more efficiently, ensuring newer and more critical vulnerabilities receive the attention they require for maintaining robust cybersecurity measures.

Explore more

How Will Whish Money and Mastercard Transform Remittances?

What happens when a nation’s survival hinges on money sent from abroad, yet the systems to deliver it are slow, expensive, and unreliable? In Lebanon, this challenge affects millions who depend on remittances to afford basic necessities like food and medicine. A groundbreaking partnership between Whish Money, a Lebanese digital financial services provider, and Mastercard, a global payments leader, is

What Is Ghost-Tapping and How Does It Threaten Digital Wallets?

Imagine walking into a store, tapping a phone to make a quick contactless payment, only to later discover that the transaction was made with stolen card data by a cybercriminal halfway across the world. This alarming scenario is becoming a reality through a sophisticated fraud technique known as ghost-tapping. Emerging from regions like Southeast Asia, where contactless payments have surged

Tesco and Aviva Partner to Offer Affordable Life Insurance

Imagine a world where securing life insurance is as simple as picking up groceries at your local supermarket, and for millions of UK families, this vision is becoming a reality through a groundbreaking partnership between Tesco, a retail giant, and Aviva, a leading insurer. With many households still underinsured or unaware of accessible financial protection options, this collaboration promises to

Snipping Tool Update Adds Window Recording for Windows Insiders

Imagine a world where capturing the perfect screen recording no longer requires hours of tedious editing to trim out irrelevant desktop clutter or reduce oversized files, and for Windows Insiders, this vision is becoming a reality with a significant update to a familiar utility. The Snipping Tool, long known as a simple screenshot application, has evolved into a more powerful

How Can AI Retain Top Customer Service Agents?

The Growing Challenge of Agent Retention in Customer Service Imagine a bustling contact center where a single top-performing agent handles complex customer queries with unmatched speed and precision, ensuring satisfaction with every interaction. Now picture the chaos when that agent leaves—service quality dips, customer complaints rise, and the cost of replacing such talent skyrockets. In an industry plagued by turnover