Skip to content

Releases: CERTCC/SSVC

v2024.3.9

16 Jan 21:50
@ahouseholder ahouseholder
v2024.3.9
57573d3
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Learn about vigilant mode.
Compare
Choose a tag to compare
v2024.3.9 Latest
Latest

This release converges feedback from the CSAF and CVE projects on the SSVC json schema. Also various dependency updates.

What's Changed

New Contributors

Full Changelog: v2024.3.8...v2024.3.9

Contributors

ahouseholder, sei-vsarvepalli, and 2 other contributors
Assets 2
Loading

SSVC v2024.3.8

01 Nov 13:52
@ahouseholder ahouseholder
v2024.3.8
0fc60ec
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Learn about vigilant mode.
Compare
Choose a tag to compare
SSVC v2024.3.8

Fixes spacing issues affecting HTML layout in decision point reference documentation.

What's Changed

Full Changelog: v2024.3.7...v2024.3.8

Contributors

sei-vsarvepalli
Assets 2
Loading

SSVC v2024.3.7

31 Oct 16:56
@ahouseholder ahouseholder
v2024.3.7
6776a79
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Learn about vigilant mode.
Compare
Choose a tag to compare
SSVC v2024.3.7

What's Changed

Full Changelog: v2024.3.6...v2024.3.7

Contributors

sei-vsarvepalli and dependabot
Assets 2
Loading

SSVC v2024.3.6

24 Oct 16:48
@ahouseholder ahouseholder
v2024.3.6
19974b8
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Learn about vigilant mode.
Compare
Choose a tag to compare
SSVC v2024.3.6

This release is primarily to address schema changes for CVE data record compatibility.

What's Changed

Dependency updates

Full Changelog: v2024.3.5...v2024.3.6

Contributors

sei-vsarvepalli and dependabot
Assets 2
Loading

SSVC v2024.3.5

01 Oct 16:50
@ahouseholder ahouseholder
v2024.3.5
c54c444
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Learn about vigilant mode.
Compare
Choose a tag to compare
SSVC v2024.3.5

Fixes a schema bug in v2024.3.4

What's Changed

Full Changelog: v2024.3.4...v2024.3.5

Contributors

sei-vsarvepalli and dependabot
Assets 2
Loading

SSVC v2024.3.4

30 Sep 15:52
@ahouseholder ahouseholder
v2024.3.4
54246ef
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Learn about vigilant mode.
Compare
Choose a tag to compare
SSVC v2024.3.4

Significant updates in this version include:

  • JSON schema updates
  • Bug fixes & Dependency updates

What's Changed

Full Changelog: v2024.3.3...v2024.3.4

Contributors

ahouseholder, sei-vsarvepalli, and dependabot
Assets 2
Loading

SSVC v2024.3.3

09 Jul 20:30
@ahouseholder ahouseholder
v2024.3.3
21a0bdc
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Learn about vigilant mode.
Compare
Choose a tag to compare
SSVC v2024.3.3

What's Changed

  • Remove polyfill.io dependency
  • Update dependencies

Full Changelog: v2024.3.2...v2024.3.3

Assets 2
Loading

SSVC v2024.3.2

25 Jun 18:00
@ahouseholder ahouseholder
v2024.3.2
cacb708
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Learn about vigilant mode.
Compare
Choose a tag to compare
SSVC v2024.3.2
  • Make json schemas available from /data/schema/ folder on site
  • Update Mission Impact in .json and .csv representations
  • Minor i18n improvements
  • Update links to CERT Guide to CVD to new site
  • Other link fixes
  • Project infrastructure improvements
  • Update Dependencies

What's Changed

New Contributors

Full Changelog: v2024.3.1...v2024.3.2

Contributors

ahouseholder, patrickmgarrity, and 2 other contributors
Assets 2
Loading

SSVC v2024.3.1

12 Apr 17:30
@ahouseholder ahouseholder
v2024.3.1
14a7ecd
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Learn about vigilant mode.
Compare
Choose a tag to compare
SSVC v2024.3.1
  • Update dependencies
  • Add 2024.3 release notes
  • Integrate site navigation with certcc.github.io home page

What's Changed

Full Changelog: v2024.3...v2024.3.1

Contributors

ahouseholder and dependabot
Assets 2
Loading

SSVC v2024.3

08 Mar 18:15
@ahouseholder ahouseholder
v2024.3
07d0e2c
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Learn about vigilant mode.
Compare
Choose a tag to compare
SSVC v2024.3

The Stakeholder-specific Vulnerability Categorization (SSVC) is a system for prioritizing actions during vulnerability management. SSVC aims to avoid one-size-fits-all solutions in favor of a modular decision-making system with clearly defined and tested parts that vulnerability managers can select and use as appropriate to their context.
In the 2024.3 release of the Stakeholder-Specific Vulnerability Classification (SSVC) system, we've made a number of significant changes:

New Web Site

This release debuts the certcc.github.io/SSVC web site to serve as the front-door for all things SSVC.

  • Diátaxis Framework - We adopted the Diátaxis Framework as a document organization framework for SSVC documentation. High level content categories are: tutorials, how-to, topics, and reference. What used to be a linear paper format is now sectioned off into more digestible pieces.
  • More call-outs and examples - With our adoption of Material for MkDocs as the underlying toolkit to construct our web site, we were able to better highlight examples, tips, and sidebar topics through the use of call-out boxes throughout the site.

New and Revised Content

  • Expanded Content - We've included more examples of Decision Points and the like directly inline where they're mentioned so readers don't need to keep flipping back and forth to their definitions for reference.
  • Bootstrapping advice - Added a Getting Started with SSVC process to help organizations go from being potential SSVC users to being actual SSVC users. This process is based on both our own experience helping organizations adopt SSVC as well as a few field reports of SSVC adoption from the community.
  • Putting the Pieces Together - Added a Putting the Pieces Together page explaining some of our philosophy regarding how to use SSVC to model decisions. SSVC provides you with the pieces and some instructions on how to assemble them, but you can customize it however you like.
  • Acuity Ramp - Added an Acuity Ramp explainer to show how an organization can grow into a decision model over time.
  • Community Engagement - Included in the new web site are a number of suggested ways for the community to interact with and contribute to the SSVC project on Github.

Versioned Objects

  • Semantic Versioning for Decision Points and Decision Point Groups - Introduced Semantic Versioning (SemVer) for Decision Points and Decision Point Groups to improve communication around decision points and decision models
  • Calendar Versioning for SSVC as a whole - With the introduction of SemVer for Decision Points and Decision Point Groups, it started to make less sense for us to talk in terms of "SSVC v2.2", especially as we were simultaneously moving away from a PDF document-focused development model towards a more flexible web-based documentation model. Beginning with this version, we anticipate that future tagged releases will use Calendar Versioning (CalVer) instead of SemVer.

Experimental & Emerging Features

There are a few improvements we've begun but have not yet fully finished, and that are largely undocumented. Most of these in the current release are python-centric. Here's a brief overview for those who want to poke around at code.

  • SSVC Python module - This release introduces the ssvc python module to allow us to more easily work with Decision Points, Decision Point Groups, Outcomes, and Policies that map from Decision Points to Outcomes. We expect to have more to say about this module in the future, but for now it's geared towards helping us produce the site documentation.
  • Policy Generator - We're prototyping a Python tool that can generate a starting policy given any combination of a Decision Point Group and Outcomes. It's not ready for prime-time yet, but folks with a bit of python skill might be in a position to try it out.
  • More Decision Points and Outcomes - In the process of exercising our Semantic Versioning rules for decision points and groups, we needed some examples of versioning events for discussion purposes. As a result, the ssvc.decision_points.cvss and ssvc.dp_groups.cvss modules contain python implementations of CVSS vector elements from CVSS v1, v2, v3, v3.1, and v4. We anticipate some of these coming in handy in the future as we look toward modeling other decisions potentially based on CVSS vector elements as well as other decision points from SSVC and elsewhere. We also included decision points and groups from CISA's customized SSVC implementation.

Other project infrastructure improvements

  • Shifted from PDF-oriented to web-oriented workflow
  • Adopted MkDocs and Material for MkDocs for static site production
  • Adopted Markdown Any Decision Records to preserve rationale and record decisions that are of significant impact to the project
  • Added documentation to the SSVC project wiki with tips for current and future contributors.
  • Began using Github's Dependabot to help maintain dependency versions.

What's Changed

Read more

Contributors

ahouseholder, j---, and 7 other contributors
Assets 2
Loading
0 Join discussion