The Struggles To Make CSAF Actionable - Sebastian Wagner

Summary

Sebastian Wagner discusses why CSAF (Common Security Advisory Framework) vulnerability advisories can be difficult to turn into actionable information for protecting real-world networks.

CSAF Advisories

Software vendors publish structured information about affected products, versions, and vulnerabilities. More than a million CSAF documents are publicly available, but the standard took many years to develop and can be bulky.

The Asset-Matching Challenge

To identify which advisories apply to an organization, CSAF data must be matched against an inventory of its software and devices. Inventories may include product and version details, but they are often incomplete—particularly in operational technology (OT) environments.

Inconsistent Vendor Data

Product names in advisories may not match the names used in an organization’s inventory. Version information can also be irregular or difficult to interpret. Some advisory fields contain only a URL or the value “unknown.”

Tooling and Data Quality

Tools exist for creating and retrieving CSAF documents, and IT teams have related tools for tasks such as working with SBOMs. However, data quality remains a problem, and Wagner says the situation is worse for OT.

Matching Approaches

A system can parse and normalize both advisories and inventory data, then match records using:

• Product identifiers, when available
• Vendor and product names
• Approximate comparisons, sometimes aided by machine learning

These approaches can work with good data, but poor-quality inputs can produce many false positives.

Example

Wagner shows matching results involving NetBox and asset-inventory software, illustrating that matching is possible but constrained by the quality of the underlying data.

Reviews, Guides, or Tutorials

None. The presentation analyzes the challenges of matching CSAF advisories to assets.

Main Speaker

Sebastian Wagner