Blog Posts
UEFI: 5 Recommendations for Securing and Restoring Trust
This blog post expands on concerns brought to light from recent UEFI attacks, such as BlackLotus, and highlights 5 recommendations to secure and restore trust in the UEFI ecosystem.
• By Vijay S. Sarvepalli
In CERT/CC Vulnerabilities
Vultron: A Protocol for Coordinated Vulnerability Disclosure
This post introduces Vultron, a protocol for multi-party coordinated vulnerability disclosure (MPCVD).
• By Allen D. Householder
In CERT/CC Vulnerabilities
UEFI – Terra Firma for Attackers
This blog post focuses on how the vulnerabilities in firmware popularized by the Uniform Extensible Firmware Interface create a lucrative target for high-profile attackers.
• By Vijay S. Sarvepalli
In CERT/CC Vulnerabilities
Probably Don’t Rely on EPSS Yet
This post evaluates the pros and cons of the Exploit Prediction Scoring System (EPSS), a data-driven model designed to estimate the probability that software vulnerabilities will be exploited in practice.
• By Jonathan Spring
In CERT/CC Vulnerabilities
The Latest Work from the SEI: Coordinated Vulnerability Disclosure, Cybersecurity Research, Cyber Risk and Resilience, and the Importance of Fostering Diversity in Software Engineering
This post highlights the latest work from the SEI in coordinated vulnerability disclosure, cyber risk and resilience management, automation, and the science of cybersecurity.
• By Douglas Schmidt (Vanderbilt University)
In CERT/CC Vulnerabilities
Vulnerabilities: Everybody’s Got One!
In this post, Leigh Metcalf describes how she pulled data from the malvuln project to explore recent vulnerabilities in both malware and non-malware to study the differences.
• By Leigh B. Metcalf
In CERT/CC Vulnerabilities
CERT/CC Comments on Standards and Guidelines to Enhance Software Supply Chain Security
This SEI Blog post shares insights from the CERT Coordination Center (CERT/CC) on proposed software supply chain security standards and guidelines.
• By Jonathan Spring
In CERT/CC Vulnerabilities
Cat and Mouse in the Age of .NET
This SEI Blog post explores evolving .NET threat landscape with challenges faced by red and blue teams and suggests ways to stay ahead of attackers.
• By Brandon Marzik
In CERT/CC Vulnerabilities
Adversarial ML Threat Matrix: Adversarial Tactics, Techniques, and Common Knowledge of Machine Learning
This SEI Blog post introduces the Adversarial ML Threat Matrix, a list of tactics to exploit machine learning models, and guidance on defense against them.
• By Jonathan Spring
In CERT/CC Vulnerabilities
Three Places to Start in Defending Against Ransomware
Learn three initial efforts for defending against ransomware in this informative SEI Blog post.
• By Timothy J. Shimeall
In CERT/CC Vulnerabilities
