Axiomatic Events that Evolved Vulnerability Databases

Axiomatic Events that Evolved Vulnerability Databases

Speakers: Johnny Shaieb, Global Delivery Leader of Vulnerability and Exposure Management, IBM

Conference: VulnCon

YouTube: https://www.youtube.com/watch?v=b-sdKHpqPEs

Overview

In his compelling VulnCon presentation, "Axiomatic Events that Evolved Vulnerability Databases," Johnny Shaieb, a PhD student at the University of Tulsa and Global Delivery Leader of Vulnerability and Exposure Management at IBM, takes the audience on a profound historical journey. Drawing from extensive interviews with key figures and a deep dive into foundational documents, Shaieb meticulously traces the origins and evolution of vulnerability management, culminating in the establishment of critical resources like the Common Vulnerabilities and Exposures (CVE) and the National Vulnerability Database (NVD). This talk is not merely a chronological account but an analytical exploration of the "aha moments" and "axiomatic events" that shaped our understanding of digital security threats.

Shaieb's research, part of his broader dissertation on dynamic vulnerability prioritization, underscores that comprehending current vulnerability challenges necessitates understanding their historical context. He reveals how seemingly disparate events—from the very first network buffer overflow to influential movies and real-world cyberattacks—collectively spurred the cybersecurity community to recognize the urgent need for standardized vulnerability cataloging and sharing. The presentation offers a unique blend of technical history, personal anecdotes from pioneers, and a forward-looking perspective on persistent challenges like asset ownership and vulnerability prioritization.

The significance of Shaieb's work lies in its ability to connect the dots between early computing challenges and the sophisticated vulnerability management systems we rely on today. By illuminating the foundational struggles and ingenious solutions of the past, the talk provides invaluable context for practitioners and researchers. It serves as a reminder that the complex landscape of cybersecurity is a product of continuous innovation, adaptation, and the collective efforts of individuals striving to bring order to digital chaos, highlighting that current problems often have roots in historical precedents.

Background

▶ Watch: Speaker introduction and talk overview (0:00)

The journey into the evolution of vulnerability databases begins not with exploits, but with prescient foresight. In 1967, two years before the advent of the ARPANET, Dr. Willis Ware, a protégé of John von Neumann and a RAND Corporation researcher, authored the seminal report "Security and Privacy in Computer Systems." Ware's report was remarkably ahead of its time, emphasizing secure design, the dangers of unauthorized access, and categorizing threats that sound strikingly modern: software failures (CVE-ish), unauthorized file access (CWE-ish), hardware level exploits, and espionage tactics (MITRE ATTACK framework-ish). He warned that "when you put a device on the network, bad things could happen," a concern that would soon manifest.

Indeed, the dawn of computer networks quickly validated Ware's concerns. In 1969, the very first message sent over the United States ARPANET, from UCLA to the Stanford Research Institute (SRI), inadvertently caused what Shaieb identifies as the first documented buffer overflow on a network. Charlie Kline, attempting to log into an SDS 940 machine from a Sigma 7, sent "l-o-g." The 'l' and 'o' were received, but the 'g' crashed the system. The SDS machine could process only 10 characters per second, while the ARPANET was configured to send 5,000 characters per second, leading to the overflow. This incident, often fondly recalled as "lo and behold the birth of the ARPANET," was, for Shaieb, the "first documented buffer overflow on a network," marking an early "aha moment" in the talk.

The early 1970s saw the emergence of the perpetual interplay between offensive and defensive capabilities. Bob Thomas, working at BBN Technologies in Boston, created Creeper, a self-replicating program, arguably the first documented worm, designed to infect 10x machines. He successfully infected 28 machines. In a classic defensive response, his colleague Ray Tomlinson (creator of email for ARPANET) developed Reaper, considered the first antivirus program, to remove Creeper. This cycle of attack and countermeasure established a fundamental paradigm in cybersecurity.

Concurrently, at MIT, Dr. Jerome Saltzer was pioneering structured vulnerability cataloging for the Multics operating system between 1972 and 1975. His work produced what is believed to be the first known structured list of vulnerabilities, laying the groundwork for how vulnerabilities would later be assessed. Saltzer's list included essential attributes: a unique name, type of issue, description, and remedy. Remarkably, his issue categories—unauthorized disclosure, unauthorized modification, and denial of service—foreshadowed the CIA triad of confidentiality, integrity, and availability by 25 years. He even watermarked his reports to detect unauthorized sharing, demonstrating an early awareness of information security.

The 1980s brought cybersecurity into public consciousness and spurred significant governmental action. The 1983 movie WarGames, depicting a high school student accidentally hacking into NORAD's WOPR supercomputer, deeply influenced President Ronald Reagan, leading to a Joint Chiefs of Staff meeting and ultimately shaping early cybersecurity legislation like NSDD 145 (National Security Decision Directive 145), which addressed securing critical infrastructure. Willis Ware, the RAND report author, even vetted the movie's technical plausibility.

This period also saw the rise of legendary figures and pivotal incidents. Cliff Stoll's pursuit of Markus Hess, a German hacker exfiltrating data to Russia, meticulously chronicled in "The Cuckoo's Egg," pioneered concepts of intrusion detection and incident response. Stoll's work highlighted the vulnerabilities in networked systems and the need for vigilant monitoring. Then came the Morris Worm in 1988, launched by Cornell grad student Robert T. Morris Jr. This worm, leveraging vulnerabilities like a Finger daemon buffer overflow, Sendmail debug remote code execution, weak passwords, and trust relationships, infected approximately 6,000 devices, causing significant disruption. The fallout directly led to DARPA funding the creation of the Computer Emergency Response Coordination Center (CERT/CC) at Carnegie Mellon, a crucial step toward coordinated incident handling.

The late 1990s served as a direct catalyst for CVE. The Eligible Receiver 97 exercise in 1997 saw an NSA red team breach US Department of Defense (DoD) networks in just four days, simulating nation-state attacks. This "no notice sanction exercise" exposed critical weaknesses and the glaring absence of a centralized, systematically cataloged, and shared vulnerability database. This foreshadowing became reality with Solar Sunrise in February 1998. In this real-world attack, two teenage boys and an 18-year-old Israeli man exploited a rpc.statd buffer overflow in Solaris to gain root access to 11 DoD systems, downloading passwords, installing sniffers, and backdoors. Secretary of Defense John Hammer called it the "most well-organized and systematic attack the Pentagon had ever experienced." These events unequivocally demonstrated the urgent, national security imperative for a unified approach to identifying, cataloging, and addressing vulnerabilities.

Key Findings

▶ Watch: First documented ARPANET buffer overflow event (7:35)

Shaieb's meticulous historical research reveals several key findings that underpin the evolution of vulnerability databases and continue to inform modern cybersecurity practices. One of the most significant "aha moments" in this history belongs to Dave Mann, a key architect of CVE. While exercising on a treadmill and reading a Scientific American article on the evolution of the periodic table, Mann realized that "a shared name precedes a shared structure." This insight, drawn from Mendeleev's initial one-dimensional listing of elements before a more complex structure, was axiomatic for CVE. It meant that the immediate priority was not a comprehensive, multi-faceted taxonomy, but rather a simple, universally accepted naming convention to bring order to the chaos of disparate vulnerability descriptions.

Another crucial finding is the consistent and perpetual interplay between offensive capabilities and defensive countermeasures. From Bob Thomas's Creeper and Ray Tomlinson's Reaper in the early 1970s to the Morris Worm and its catalyst role in creating CERT/CC, every significant offensive breakthrough has been met with a corresponding push for enhanced defensive strategies and infrastructure. This dynamic underscores that cybersecurity is not a static state but an ongoing, iterative process of adaptation.

The talk also highlights the profound impact of public awareness and real-world incidents in driving the need for structured security initiatives. Events like the movie WarGames, which directly influenced President Reagan and cybersecurity legislation, and major attacks like Solar Sunrise, which spurred the creation of CVE, demonstrate that high-profile events are often the necessary catalysts for political will and funding to address systemic security flaws. These moments transformed theoretical risks into tangible threats, demanding actionable solutions.

Furthermore, Shaieb's narrative illustrates the critical shift in understanding what constitutes a "vulnerability." Initially, the focus was on specific flaws directly enabling system compromise. However, the debate surrounding the "finger command" and its informational output led to the realization that mere "enumeration" was insufficient. This evolved into the concept of "exposure," acknowledging that configurations or information not directly exploitable could still contribute to an attack. This broader perspective, advocated by Steve Christie, expanded the scope of what needed to be tracked and managed, leading to the "Common Vulnerabilities and Exposures" acronym we know today.

Finally, the talk implicitly, but powerfully, underscores the indispensable role of human collaboration, relationships, and advocacy in establishing and sustaining foundational security initiatives. The network of individuals from academia, government, and industry—such as Steve Christie, Dave Mann, Alan Paller, and Marji Zack—who championed CVE and NVD, often overcoming funding challenges and philosophical debates, were instrumental in translating abstract needs into concrete, widely adopted standards. This human element is a recurring theme, emphasizing that technical progress is often propelled by dedicated individuals and their collective efforts.

Technical Deep Dive

▶ Watch: Solar Sunrise event catalyzes CVE development (30:00)

The technical evolution of vulnerability databases is a story of increasing sophistication, driven by the expanding complexity of networked systems and the growing threat landscape. Early attempts at cataloging, such as Dr. Jerome Saltzer's Multics vulnerability list (1972-1975), laid fundamental groundwork. Saltzer’s list, a structured collection of issues, included attributes like a unique name, the type of issue, a detailed description, and a suggested remedy. His categories—unauthorized disclosure, unauthorized modification, and denial of service—demonstrated an early, intuitive grasp of what would become the CIA triad (Confidentiality, Integrity, Availability). This early work showed the nascent need for structured data to manage security flaws.

As systems became more complex, the need for a more comprehensive approach became evident. Peter Mell, a master's student at UC Davis, funded by DARPA to build an intrusion detection system (IDS), encountered a significant hurdle: a lack of documented exploits to test his system. This led him to build his own exploit repository, initially known as the Global Attack Toolkit (GAT). Mell sourced exploits from early hacking communities like Root Shell, Phidor's Playhouse (which was synonymous with Bugtraq), and the elusive Legacy Hacking site. This repository, managed in an Access 97 database, contained detailed attributes for each exploit, such as whether it was remote or local, its penetration capabilities, scan methods, target type, and transmission method. Mell's approach was innovative because it viewed security from the perspective of a threat actor, focusing on how systems could be attacked.

Mell’s GAT later evolved into ICAT (initially "Internet Catalog of Assailable Technologies," later "Internet Categorization of Attack Toolkits"). While still retaining an attack-centric view, ICAT shifted its primary focus from exploits to vulnerabilities, recognizing that understanding the underlying flaws was paramount. It incorporated attributes like attack requirements, format, goal (e.g., DOS, local), and detection methods. This marked a significant step towards a more structured and comprehensive approach to vulnerability information, laying the groundwork for the NVD.

The true genesis of CVE, however, came from the urgent need for a common language across the fragmented security ecosystem of the late 1990s. Dave Mann at MITRE was tasked with consolidating intrusion detection logs, scans, and advisories into a centralized database. Frustrated by the lack of a consistent naming scheme, Mann, in a conversation with Jim Williams, was prompted to write a paper. This led to the first draft of "Towards the common enumeration of vulnerabilities," which prematurely circulated. Mann's "aha moment," inspired by the periodic table, was realizing that a shared name precedes a shared structure. This insight was critical for CVE's initial design philosophy: start with a simple, universally accepted identifier.

Consequently, early CVE entries focused on a unique ID and a concise description. Over time, references were added to link to external advisories and reports, enhancing the utility of each entry. The development of CVE was a collaborative effort, initially fostered through a mailing list and "Birds of a Feather" meetings, which brought together vendors and experts, eventually forming the CVE Editorial Board.

A pivotal philosophical and technical shift occurred in August 1999: the debate over "enumeration" versus "exposure." The core issue was whether CVE should list only directly exploitable flaws (true "vulnerabilities") or also include configurations or informational disclosures that could contribute to an attack, even if not directly exploitable. The finger command, which could reveal sensitive user information, served as a prime example. While not a direct exploit, such information could aid an attacker. Steve Christie proposed the term "exposure" to encompass these broader risks, allowing the CVE acronym to remain while expanding its scope to Common Vulnerabilities and Exposures, reflecting a more holistic understanding of attack surfaces.

The National Vulnerability Database (NVD), established in 2005, built upon the foundation of ICAT. It provided a national, government-maintained, and frequently updated database, enhancing CVE entries with additional context such as CVSS (Common Vulnerability Scoring System) scores, CPE (Common Platform Enumeration), and CWE (Common Weakness Enumeration) mappings. NVD's journey was not without challenges, facing funding shortfalls in 2001 and 2004, saved notably by Alan Paller of SANS and an unnamed DHS executive, respectively. This demonstrated the ongoing need for dedicated resources and advocacy to maintain such critical public infrastructure. The evolution from Saltzer's early lists to today's NVD showcases a continuous drive to categorize, understand, and mitigate digital risks through increasingly standardized and detailed technical information.

Demo / Proof of Concept

▶ Watch: Dave Mann's CVE naming 'Aha Moment' (33:45)

This technical article is based on a historical narrative and does not include a live demonstration or proof of concept of a specific exploit or tool. Johnny Shaieb's presentation focused on recounting the historical events and "aha moments" that led to the development of vulnerability databases, rather than showcasing a particular technology in action. The "demonstration" in this context is the meticulously researched historical timeline itself, illustrating the evolution of cybersecurity understanding.

Defensive Implications

▶ Watch: Q&A: Future challenges and asset ownership (50:00)

The detailed historical account provided by Shaieb offers profound defensive implications, underscoring that many contemporary cybersecurity challenges are echoes of past struggles. Understanding this evolution is crucial for developing more resilient defensive strategies.

Firstly, Shaieb explicitly highlights asset ownership as the number one leading cause of vulnerability backlog by a "distant mile." This is a critical takeaway for defenders. Organizations must move beyond merely scanning for vulnerabilities; they need comprehensive, continuously updated asset inventories that clearly define ownership across all digital assets. This includes traditional IT infrastructure, Operational Technology (OT), Internet of Things (IoT) devices, cloud environments, and even emerging technologies like connected cars. Without knowing what assets exist, who is responsible for them, and where they reside, effective vulnerability management is impossible.

Secondly, the evolution of vulnerability scoring and prioritization is a key lesson. Shaieb discusses the early reliance on basic attributes and the later development of CVSS. However, he emphasizes the need to move beyond raw severity scores to a more dynamic, threat-informed prioritization model. He specifically references the Exploit Prediction Scoring System (EPSS), championed by Jay Jacobs, and his own patent on prioritizing vulnerabilities using weaponization. Defenders should actively integrate threat intelligence and real-world exploitation data into their vulnerability management programs to prioritize patching efforts. Focusing on vulnerabilities that are actively being exploited or have known weaponization is far more impactful than simply addressing every high-severity CVE.

Thirdly, the entire narrative reinforces the foundational importance of structured vulnerability data. The chaos that existed before CVE, where different vendors used inconsistent terms for the same flaw, crippled interoperability and efficient defense. The existence of CVE and NVD today, while not perfect, provides a common language essential for threat intelligence sharing, automated scanning, and security tooling. Defenders should leverage these standardized identifiers (CVE IDs, CWE, CPE) across their security operations to ensure consistency, improve communication, and enable better automation.

Finally, the historical context reveals that cybersecurity is a journey of continuous improvement and adaptation. The "perpetual interplay between offensive capabilities and defensive countermeasures" means that defenders can never rest. The creation of CERT/CC after the Morris Worm, the establishment of US Cyber Command after Eligible Receiver 97, and the ongoing evolution of NVD demonstrate that significant defensive advancements often arise from learning from past incidents. Defenders must foster a culture of learning, incident response, and proactive adaptation to emerging threats, rather than relying on static security postures. The lesson from history is clear: expect new challenges, learn from failures, and continuously evolve defensive strategies.

Key Takeaways

• Standardized Naming is Foundational: The "aha moment" that "a shared name precedes a shared structure" was critical. The creation of CVE provided the essential common language needed to bring order to chaotic vulnerability reporting, enabling interoperability and collaboration across the security community.
• Asset Ownership is Paramount: The single biggest impediment to effective vulnerability management is the lack of clear, comprehensive asset ownership and inventory. Defenders must prioritize establishing and maintaining accurate asset registers across all IT, OT, IoT, and cloud environments.
• Prioritize Beyond Severity: Traditional vulnerability scoring (e.g., CVSS base scores) is insufficient. Prioritization should be dynamic and incorporate real-world exploitation intelligence, such as EPSS and weaponization data, to focus resources on the most impactful threats.
• Offensive and Defensive are Intertwined: Cybersecurity history is a continuous cycle of new offensive techniques driving defensive innovations. This perpetual interplay necessitates constant vigilance, adaptation, and investment in both threat intelligence and defensive capabilities.
• Real-World Events Drive Progress: Major incidents like the Morris Worm and Solar Sunrise, alongside public awareness campaigns (e.g., WarGames), have historically been the catalysts for significant advancements in cybersecurity infrastructure, policy, and research, leading to the creation of entities like CERT/CC and NVD.
• Human Collaboration is Essential: The establishment and sustained success of foundational security initiatives like CVE and NVD relied heavily on the collaborative efforts, advocacy, and personal relationships of dedicated individuals from government, academia, and industry.

About the Speaker(s)

Johnny Shaieb is a PhD student at the University of Tulsa, where his dissertation research focuses on the dynamic prioritization of vulnerabilities using action research. In his professional life, he serves as the Global Delivery Leader of Vulnerability and Exposure Management at IBM. His extensive research for this talk involved conducting numerous interviews with pivotal figures in cybersecurity history, including Dave Mann, Steve Christie, Jay Jacobs, Brian Martin, and Dr. Gene Spafford, underscoring his commitment to primary historical research and understanding the foundational aspects of vulnerability management. Shaieb's work bridges academic inquiry with practical industry experience, aiming to improve how organizations manage and prioritize security risks.