{"id":2786,"date":"2025-04-17T00:08:08","date_gmt":"2025-04-17T00:08:08","guid":{"rendered":"https:\/\/cybersecurityinfocus.com\/?p=2786"},"modified":"2025-04-17T00:08:08","modified_gmt":"2025-04-17T00:08:08","slug":"mitre-funding-still-in-up-in-the-air-say-experts","status":"publish","type":"post","link":"https:\/\/cybersecurityinfocus.com\/?p=2786","title":{"rendered":"MITRE funding still in up in the air, say experts"},"content":{"rendered":"
\n
\n
\n
\n
<\/div>\n

Infosec pros are relieved that the Trump administration at the last minute extended support for MITRE\u2019s Common Vulnerabilities and Exposures (CVE) database, but at least one wonders if funding will continue.<\/p>\n

The program was set to expire today, but last night the US Cybersecurity and Infrastructure Security Agency (CISA) said the contract with MITRE has been extended<\/a>. According to a source, the contract will now run out in 11 months unless a new one is in place.<\/p>\n

Bruce Schneier, fellow and lecturer at Harvard University\u2019s Kennedy School, board member of the Electronic Frontier Foundation, and chief security officer at Inrupt Inc., has worries about the government leaving renewal of the contract so long before acting.<\/p>\n

\u201cThe funding was cut randomly and without thought because lots of things are being cut,\u201d he said in an interview. Then, \u201csomeone noticed that this is actually important, and re-instated funding for some time. But there\u2019s no confidence that the funding will continue. So I think the community needs to figure out how to do this without the help of the United States government \u2026 It will be interesting to figure out what they [MITRE] will do: Will they self-fund something? Will the EU step in? Who knows? I don\u2019t know who else would do it.\u201d<\/p>\n

The MITRE program, he said, \u201cis the kind of good that helps the US and the world.\u201d<\/p>\n

\u2018Too important not to be funded\u2019<\/h2>\n

But, he added, \u201cThis is too important to go back to the old way where we didn\u2019t have this [CVE database]. It\u2019s a consolidated way of writing out and talking about vulnerabilities, which is really important.\u201d<\/p>\n

Asked whether leaving a renewal decision to the last minute was just a mistake of a new administration focused on other things, Schneier said he suspects it was decided that \u201cthis is within the blast radius\u201d of cost cutting. Someone, he said, decided, \u201c\u2019We\u2019re cutting everything, this is part of everything.\u2019 That\u2019s happened a bunch of times. Like [the way] they fired nuclear safety engineers<\/a>, and then they said, \u2018Wait, we might need those,\u2019 so they tried to get them back. My guess is that\u2019s what happened.\u201d<\/p>\n

Schneier couldn\u2019t say why the contract was only extended for 11 months. \u201cI don\u2019t think there\u2019s a signal in that at all.\u201d<\/p>\n

MITRE\u2019s\u00a0CVE program<\/a>\u00a0is the de facto standard for identifying vulnerabilities and guiding defenders\u2019 vulnerability management programs. It provides foundational data to cybersecurity products across vulnerability management, cyber threat intelligence, security information, event management, and endpoint detection and response.<\/p>\n

\u201cThe CISA funding extension will hopefully allow for an orderly transition,\u201d Johannes Ullrich, dean of research at the SANS Institute, said in an email. \u201cCVE numbers are critical to properly catalog and respond to new vulnerabilities.\u201d\u00a0\u00a0<\/p>\n

MITRE operating the CVE system under a US government contract hasn\u2019t been without controversy before, he added. Some members of the CVE board suggested setting up a new entity, The CVE Foundation<\/a>, to allow for more diverse funding from international stakeholders.<\/p>\n

That\u2019s one possible solution, Schneier said. \u201cSomething has to be done. The US is not a reliable partner here.\u201d<\/p>\n

Echoing Schneier\u2019s concerns, on Wednesday, the CVE board announced the establishment of that entity. The new CVE Foundation will focus solely on continuing the mission of delivering high-quality vulnerability identification and maintaining the integrity and availability of CVE data for defenders worldwide,\u00a0organizers said. The announcement didn\u2019t detail how it would be funded.<\/p>\n

\u2018Shouldn\u2019t be begging\u2019<\/h2>\n

\u201cMITRE leaders have been begging for more private funding for years,\u201d said Roger Grimes, data driven defense evangelist at KnowBe4, in an email.<\/p>\n

\u201cThis isn\u2019t a type of program where the program leaders should be begging for funding. It should be fully funded, correctly resourced, and able to do a superb job for its mission. It\u2019s an incredibly valuable resource and the entire cybersecurity community wants to know if it will be given the attention and funding it has always needed for the seriousness of its mission. Great to hear it\u2019s being extended, but the devil is in the details.\u201d<\/p>\n

\u201cNow,\u201d he said, \u201cthe question is \u2014 is it being funded at the same level, less, or even better? Because the program has always had a ton of deficiencies for years that the community has been hoping could be improved. That program has been existing on a shoestring budget for years, hanging on by a thread, ready to collapse\u00a0in usefulness at any minute.<\/p>\n

\u201cI hope we can all go to sleep better at night knowing that it is not only getting extended, but will actually be improved and become the service it should have always been\u2026so that the program\u2019s leaders can do less begging for funding and more managing and improving the program.\u201d<\/p>\n<\/div>\n<\/div>\n<\/div>\n<\/div>","protected":false},"excerpt":{"rendered":"

Infosec pros are relieved that the Trump administration at the last minute extended support for MITRE\u2019s Common Vulnerabilities and Exposures (CVE) database, but at least one wonders if funding will continue. The program was set to expire today, but last night the US Cybersecurity and Infrastructure Security Agency (CISA) said the contract with MITRE has […]<\/p>\n","protected":false},"author":0,"featured_media":2787,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[3],"tags":[],"class_list":["post-2786","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-education"],"_links":{"self":[{"href":"https:\/\/cybersecurityinfocus.com\/index.php?rest_route=\/wp\/v2\/posts\/2786"}],"collection":[{"href":"https:\/\/cybersecurityinfocus.com\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/cybersecurityinfocus.com\/index.php?rest_route=\/wp\/v2\/types\/post"}],"replies":[{"embeddable":true,"href":"https:\/\/cybersecurityinfocus.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=2786"}],"version-history":[{"count":0,"href":"https:\/\/cybersecurityinfocus.com\/index.php?rest_route=\/wp\/v2\/posts\/2786\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/cybersecurityinfocus.com\/index.php?rest_route=\/wp\/v2\/media\/2787"}],"wp:attachment":[{"href":"https:\/\/cybersecurityinfocus.com\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=2786"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/cybersecurityinfocus.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=2786"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/cybersecurityinfocus.com\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=2786"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}