NVD delays highlight vulnerability management woes: Put malware first

A decision by the National Institute of Standards and Technology (NIST) to change how it maintains the widely used National Vulnerability Database (NVD) has focused attention on the brittle nature of current enterprise vulnerability management processes.

On February 13, NIST announced, seemingly out of the blue, what amounted to a scaling back of its vulnerability analysis contributions to the database — and its related plan to hand off that task to a consortium of other organizations. At the time, NIST …

attention blue change current database decision enterprise february malware management national national vulnerability database nature nist nvd processes scaling standards technology vulnerability vulnerability database vulnerability management