CISA-ENISA Joint Messaging

CISA-ENISA Joint Messaging

Speakers: Lindsey Cerkovnik (Branch Chief for Vulnerability Response and Coordination, CISA); Nuno Rodrigues Carvalho (Head of Sector, ENISA)

Conference: VulnCon

YouTube: https://www.youtube.com/watch?v=rrSIeBnJfC0

Overview

In a pivotal address at VulnCon, representatives from the US Cybersecurity and Infrastructure Security Agency (CISA) and the European Union Agency for Cybersecurity (ENISA) outlined a shared vision for the future of vulnerability management, emphasizing a critical shift from program growth to a focused quality era. Lindsey Cerkovnik, Branch Chief for Vulnerability Response and Coordination at CISA, and Nuno Rodrigues Carvalho, Head of Sector for Situational Awareness and Incident Reporting at ENISA, highlighted the profound changes impacting the vulnerability ecosystem, including an unprecedented surge in vulnerability reports and the emergence of AI-powered vulnerability discovery. Their joint presentation underscored the necessity of robust international collaboration, particularly between the US and EU, to ensure the Common Vulnerabilities and Exposures (CVE) Program remains effective, interoperable, and globally relevant.

The core of their message revolved around the imperative to evolve the CVE Program to meet contemporary challenges. Cerkovnik articulated CISA’s unwavering commitment as the program's long-standing sponsor, stressing that active participation in CVE is viewed as a vital act of "protecting life and property" by enabling global defenders and tooling vendors. Carvalho detailed ENISA's escalating role within the CVE framework, from its establishment as a CNA in 2004 to its recent elevation as a Root CNA, and its ambition to become a top-level root. Both speakers converged on the theme of interoperability, asserting that a unified vision, rather than fragmented efforts, is paramount for stakeholders operating across international boundaries.

This talk served as a strategic declaration, signaling a concerted effort to modernize the CVE Program's infrastructure, diversify its participant base, and enhance the overall quality of both its data and user experience. It acknowledged past criticisms and pain points, particularly from the challenging "roller coaster" year preceding the conference, and positioned the current juncture as a crucial turning point. The speakers called for active community engagement through working groups and direct feedback, asserting that collective input is essential to shape a resilient and effective vulnerability management ecosystem for the coming decades.

Background

▶ Watch: CISA's deep commitment to the CVE program (4:00)

The landscape of cybersecurity vulnerabilities is undergoing a significant transformation, marked by an exponential increase in reported vulnerabilities and the advent of sophisticated discovery methods, notably AI-powered vulnerability discovery. Lindsey Cerkovnik of CISA highlighted that her Coordinated Vulnerability Disclosure (CVD) team, which handles thousands of cases annually, has observed a "tremendous increase in reporting." This surge is not merely a quantitative change but signifies a qualitative shift, posing challenges for existing, often manual, vulnerability management processes. The speakers stressed that the traditional methods, while effective for a time, are becoming unsustainable and require fundamental re-evaluation.

For over a decade, the CVE Program has primarily been in a "growth era," expanding from a single CNA (CVE Numbering Authority) to over 500 CNAs across 41 countries. While this growth is a testament to the program's global adoption, Cerkovnik conceded that "growth doesn't always equal quality." This recognition forms the bedrock of the announced shift towards a quality era, focusing not just on the volume of CVEs but on the richness, accuracy, and utility of the data, as well as the overall user experience within the program.

The problem of vulnerability management is inherently global, transcending national borders and jurisdictions. CISA, as the sole sponsor of the CVE Program for decades, has recognized that a US-centric approach is no longer viable for a program with such international reach. This understanding has catalyzed the strengthened partnership with ENISA, the European Union's cybersecurity agency. ENISA's role is distinct from CISA's; as an executive agency supporting EU member states and the internal market, it focuses on policy, incident reporting (e.g., the NIS2 Directive), and building EU-level vulnerability services capacity, rather than direct coordinated vulnerability disclosure. This transatlantic collaboration is thus a logical and necessary step to ensure the CVE Program's continued relevance and effectiveness on a global scale, fostering interoperability and a unified vision across diverse legislative and operational frameworks.

Key Findings

▶ Watch: CVE program shifts focus to quality of data and experience (10:45)

The central message of the CISA-ENISA joint presentation is the recognition of a critical turning point in global vulnerability management, necessitating a strategic evolution of the CVE Program. The key findings and contributions presented are:

1. Shift to a "Quality Era": The CVE Program is officially transitioning from a decade of organic growth (now boasting over 500 CNAs in 41 countries) to a focused "quality era." This means prioritizing not just the volume of CVEs but the data quality, the quality of the program experience (e.g., pain-free submission, efficient UIs), and the overall usefulness of the data for defenders.
2. Unprecedented Growth in Vulnerability Reports: Both CISA and ENISA are observing a significant increase in vulnerability reporting, partly attributed to emerging technologies like AI-powered vulnerability discovery. This necessitates greater automation, scalability, and efficiency in vulnerability disclosure and management processes.
3. Enhanced Internationalization and Interoperability: The problem of vulnerabilities is not US-centric, leading to a crucial partnership between CISA and ENISA. Their collaboration aims to ensure a united vision for the CVE Program, fostering interoperability across different legislative mandates (e.g., EU's NIS2) and preventing fragmentation of the vulnerability ecosystem for international stakeholders.
4. ENISA's Ascending Role: ENISA has significantly stepped up its involvement, evolving from a CNA in 2004 to a Root CNA in 2023. It is actively building EU vulnerability services capacity, including a Single Reporting Platform and an EU KEV (Known Exploited Vulnerabilities) catalog, and harbors aspirations to become a top-level root CNA to serve as a regional hub for the program.
5. Focus on Program Diversification: The CVE Program seeks to broaden its participant base beyond traditional vendors to include critical communities like AI organizations, the open-source community, and academia. This diversification is seen as essential for capturing a more comprehensive view of the vulnerability landscape.
6. Infrastructure Modernization: There is an acknowledged need for substantial modernization of the CVE Program's underlying infrastructure to make the experience "better, faster, more efficient, and less painful" for all participants, from researchers to CNAs.
7. Importance of Trust and Partnerships: The program's effectiveness relies heavily on trusted relationships and "face recognition" among participants. CISA and ENISA emphasize the value of direct engagement, working groups, and sharing the "grit" of the disclosure process to build a strong, collaborative community.

Technical Deep Dive

▶ Watch: Diversifying CVE program: AI, open source, academia (26:00)

The CISA-ENISA joint messaging delves into the operational and strategic mechanisms underpinning global vulnerability management, primarily through the lens of the CVE Program. CISA, as the long-standing federal sponsor of CVE, plays a multifaceted role. Its Vulnerability Response and Coordination Branch is responsible for the Known Exploited Vulnerabilities (KEV) Catalog, a critical resource that mandates federal civilian executive branch agencies to patch confirmed exploited vulnerabilities. This catalog is a tangible output of CISA's intelligence gathering on in-the-wild exploitation. Furthermore, CISA's Coordinated Vulnerability Disclosure (CVD) team is a small but mighty operation, managing between 250 and 300 active cases at any given time, processing thousands annually, which directly results in the assignment and disclosure of CVEs.

A notable CISA initiative is Vulnerability Enrichment (Vuln Enrichment), a project focused on augmenting incomplete CVE records with additional useful information. This project also serves as an experimental platform to identify what vulnerability data truly adds value to defenders and justifies investment of time and taxpayer dollars. Cerkovnik highlighted its importance in creating a feedback loop for reinvestment in the vulnerability ecosystem. The sponsorship of the CVE program itself, which CISA has maintained for a couple of decades, is underscored as a high-priority mission, requiring approval at the Secretary's level for CISA personnel to travel during government shutdowns, demonstrating its perceived criticality in "protecting life and property."

ENISA, while a "different beast" from CISA due to its role as an executive agency supporting EU member states, is significantly expanding its footprint in the vulnerability space. Nuno Rodrigues Carvalho detailed ENISA's responsibilities in situational awareness and incident reporting, including managing a database called CISA (not to be confused with the US agency) and fulfilling reporting obligations under EU legislation. A major ongoing project is the development of a Single Reporting Platform, mandated by the NIS2 Directive, which is targeted for readiness by September 11 (9/11). This platform is poised to have a "huge impact" on vulnerability reporting within the EU.

ENISA's commitment to vulnerability management is further demonstrated by its progression within the CVE Program. After being a CNA since 2004, ENISA achieved Root CNA status in November of the preceding year (2023). This advancement empowers ENISA to onboard and manage new CNAs, with a strategic goal to bring all national CERTs (Computer Emergency Response Teams) under its root. This regionalization is a key aspect of the program's internationalization strategy, aiming to increase the number of European CNAs (currently 83 out of 500+, approximately one-fifth) and diversify the types of participating organizations. ENISA is also working on building its own EU vulnerability services capacity, including the ambitious development of an EU KEV catalog, which will integrate information from CISA, the CRA single reporting platform, and national CERTs, ensuring alignment with global standards while serving EU-specific needs.

A cornerstone of the CISA-ENISA collaboration is the principle of interoperability. Despite distinct legislative mandates and operational structures—ENISA's actions are often driven by EU legislation, unlike CISA's federal sponsorship—both agencies are committed to building systems and processes that are aligned. As Cerkovnik eloquently put it, "interoperability isn't a question of should we, it's a question of how do we do this." This ensures that international stakeholders, who often have operations and reporting requirements in both the US and Europe, do not face a fragmented ecosystem. The shared objective is a "united vision" for the CVE Program that prioritizes the "smoothest" possible experience for defenders.

The strategic shift to a quality era extends beyond mere data accuracy. It encompasses the "quality of experience," addressing pain points in vulnerability submission for researchers and ensuring efficient, user-friendly UIs and infrastructure. This necessitates infrastructure modernization, acknowledged as an area with "room for improvement." CISA and ENISA aim to make the CVE Program "better, faster, more efficient, and less painful" to use, particularly in anticipation of the growing volume of vulnerability reports. This modernization effort is a joint focus for CISA, the CVE Secretariat (managed by MITRE), and ENISA.

Program diversification is another technical and strategic imperative. The organic growth of CVE has, at times, overlooked critical segments of the cybersecurity community. The call for diversification specifically targets AI organizations, recognizing their emerging role in vulnerability discovery and creation. The open-source community, which has historically had a "complicated relationship" with CVE, is another focus area, with a commitment to being more responsive to its unique needs. Academia and researcher groups are also being actively integrated, exemplified by a dedicated researcher working group, to ensure their contributions are effectively captured and integrated into the CVE framework.

Finally, the speakers emphasized the critical role of partnerships and trust. The CVE Program operates on a foundation of trust rather than enforcement. Building "trusted relationships" through direct interaction, such as at conferences and within working groups, and fostering "face recognition" among key operational personnel (e.g., Alec Summers and his team at the CVE Secretariat) is deemed vital. Cerkovnik drew parallels between the often "thankless job" of vulnerability disclosure analysts and the broader efforts within the CVE Program, highlighting the "shared grit" and sense of making a difference against "the baddies." The Log4j Shell incident served as a key learning experience for CISA, demonstrating the power of operational collaboration through initiatives like the affected products repository on GitHub, which enabled open, transparent, and international coordination with CERTs at unprecedented speed, setting the stage for future projects like Vuln Enrichment.

Demo / Proof of Concept

▶ Watch: Building trust and "face recognition" in CVE partnerships (30:00)

This talk was a strategic discussion and policy announcement rather than a technical demonstration. No live demo or proof of concept of a tool, code, or specific vulnerability was presented during the session. The speakers focused on outlining the strategic direction, ongoing initiatives, and future plans for the CVE Program and vulnerability management efforts by CISA and ENISA.

Defensive Implications

▶ Watch: Log4j Shell's impact on CISA's operational collaboration (45:30)

The CISA-ENISA joint messaging carries significant implications for defenders worldwide, signaling a future where vulnerability management is more structured, transparent, and globally coordinated. First and foremost, the shift to a quality era for the CVE Program means defenders can anticipate more reliable, complete, and useful vulnerability data. This improved data quality, along with enhanced user experience, should streamline the process of identifying, assessing, and prioritizing vulnerabilities, ultimately leading to more effective patching and risk mitigation.

The commitment to internationalization and interoperability directly benefits organizations with global operations. Defenders should expect less fragmentation in vulnerability reporting and data standards between the US and EU ecosystems. This means that tools and processes designed to consume CVE data will likely function more seamlessly across different regions, reducing the burden of adapting to disparate reporting requirements or data formats. ENISA's development of an EU KEV catalog, leveraging CISA's existing Known Exploited Vulnerabilities (KEV) Catalog and other EU sources, will provide European defenders with a critical, regionally tailored resource for prioritizing the most dangerous, actively exploited threats.

The anticipated surge in vulnerability reports, driven by emerging technologies like AI-powered vulnerability discovery, underscores the urgent need for defenders to adopt scalable and automated vulnerability management solutions. Organizations must prepare for a higher volume of vulnerability disclosures, both valid and potentially "slop" (low-value reports), necessitating robust filtering, analysis, and prioritization capabilities. The CVE Program's focus on infrastructure modernization aims to support this scale, ultimately providing defenders with more efficient access to CVE data.

Defenders are strongly encouraged to actively engage with the CVE Program through its working groups. These forums are identified as crucial feedback loops for shaping the program's future, from data schema improvements to the creation of new working groups addressing niche or emerging areas like AI-specific vulnerabilities. Providing feedback can directly influence how the program evolves to better serve the needs of the defense community.

Finally, the emphasis on partnerships and trust highlights the collaborative nature of effective cybersecurity. Defenders should foster strong relationships with their respective national CERTs, industry peers, and agencies like CISA and ENISA. The lessons learned from incidents like Log4j Shell, which spurred CISA's innovative use of an open-source GitHub repository for affected products and international CERT coordination, demonstrate the power of transparent, collaborative operational responses in mitigating widespread threats.

Key Takeaways

• Shift to a Quality Era: The CVE Program is transitioning from a growth-focused decade to prioritize data quality, user experience, and overall usefulness for defenders.
• Transatlantic Interoperability: CISA and ENISA are committed to a united vision for the CVE Program, ensuring interoperability between US and EU vulnerability management efforts to prevent fragmentation for international stakeholders.
• Anticipated Vulnerability Surge: Emerging technologies, especially AI-powered discovery, are expected to significantly increase vulnerability reporting, demanding scalable and automated defensive strategies.
• Infrastructure Modernization: The CVE Program will undergo significant infrastructure improvements to enhance efficiency, user experience, and scalability for managing increasing vulnerability reports.
• ENISA's Growing Influence: ENISA is expanding its role within the CVE Program, evolving to a Root CNA, building EU vulnerability services (including a Single Reporting Platform and EU KEV catalog), and aspiring to become a top-level root.
• Community Feedback is Crucial: Active participation in CVE working groups and providing direct feedback is vital for shaping the program's future, ensuring it meets the evolving needs of the global defense community.

About the Speaker(s)

Lindsey Cerkovnik serves as the Branch Chief for Vulnerability Response and Coordination at CISA (Cybersecurity and Infrastructure Security Agency). Her team is responsible for critical initiatives including the Known Exploited Vulnerabilities (KEV) Catalog, which drives federal patching directives, and Coordinated Vulnerability Disclosure (CVD), handling thousands of cases annually. She also oversees the Vulnerability Enrichment (Vuln Enrichment) project and CISA's long-standing sponsorship of the CVE Program. With a background as a disclosure analyst, she emphasizes the importance of direct operational engagement and partnerships in the vulnerability management space.

Nuno Rodrigues Carvalho is the Head of Sector for Situational Awareness and Incident Reporting at ENISA (European Union Agency for Cybersecurity). In this role, he is involved in incident reporting under EU legislation, managing databases, and overseeing the development of the Single Reporting Platform mandated by the NIS2 Directive. Carvalho highlights ENISA's expanding role in the vulnerability space, having progressed from a CNA to a Root CNA within the CVE Program, with ambitions to become a top-level root to support EU member states and foster greater internationalization and interoperability in vulnerability management.