Exchange of incident and vulnerability data

[Jeffrey Carpenter <jjc@cert.org>]

> From the GRIP minutes:

> There was a suggestion to develop a document that would describe a common
> formatting for vulnerability reports. Computer incident response teams
> (e.g., CERT/CC), product vendors, and other organizations create their own
> documents with unique formatting. If these conformed to a set of basic
> guidelines, software could be written to parse the text to facilitate
> forwarding pertinent information to those who need it. This is currently a
> difficult task given the variety of formats. It was decided to encourage
> the author to write the draft document and the group would decide how to
> handle it once it existed.

I am currently working on this issue and on a paper related to this
subject and am interested in talking with the folks working on this
draft document.  Please drop me a note if you are working on it.

Thanks,


	jeff