Security measurement

The Red Hat® Security Response Team is committed to providing tools and data to help security measurement. Part of this commitment is our participation at board level in the MITRE Common Vulnerabilities and Exposures (CVE) and Open Vulnerability and Assessment Language (OVAL) projects.

We also provide reports and metrics. But more importantly we provide the raw data so customers and researchers can produce their own metrics for their unique situations and hold us accountable.

OVAL definitions

OVAL definitions are available for all vulnerabilities that affect Red Hat Enterprise Linux® 3, 4, 5, and 6:

Vulnerability statements and acknowledgments

The Red Hat Security Response Team publishes acknowledgments and official statements for vulnerabilities currently under investigation and for vulnerabilities that don’t affect our products and services:

These statements are also available directly in Red Hat vulnerabilities by CVE name.

Vulnerability data

CVE to date, CVE to severity, CVE to CVSS mapping

This data source maps CVE names to the dates the issues were first known to the public. This helps generate statistics based on days of risk. This data source also captures the severity of the issues and how we found out about them (dates and sources).

Although the dates may come from third parties, the severity classifications are given by the Red Hat Security Response Team and are specific to Red Hat, and thus will vary for other distributions and vendors.

This file is created manually and is updated every 1 or 2 weeks (or by request by contacting secalert@redhat.com):

RHSA to date mapping

This data source is a mapping of Red Hat security advisories to the dates and times the advisories were issued. Most of this data comes automatically from the Red Hat Network, but some entries requiring manual adjustment have been annotated:

RHSA to CVE and CPE mapping

This data source is a mapping of Red Hat Security Advisories to the vulnerabilities fixed (identified by CVE name). This file contains the product names affected in Common Platform Enumeration (CPE) format and the package names, allowing the file to be filtered by a product or package subset:

CPE lists for default installations

Red Hat Enterprise Linux ships with a large number of packages, but they’re not all installed by default. These files give lists of packages in default installations, which can be used to filter the metrics. The format is the CPE name with the package name appended:

CPE dictionary

CPE is a structured naming scheme for IT systems, software, and packages. For reference, we provide a dictionary that maps the CPE names we use to Red Hat product descriptions. Some of these CPE names are for new products that aren’t in the official CPE dictionary, and should therefore be treated as temporary CPE names:

Data analysis

We provide a Perl script that creates reports based on the cve_dates.txt, release_dates.txt, and rhsamapcpe.txt data sources above.

For a given product, such as Red Hat Enterprise Linux, and a date range, the script can list all the security issues fixed by severity and gives a days of risk metric (displayed as Average is x days) as well as vulnerability workflow statistics. For example, run the following command to create a summary report of all critical advisories for Red Hat Enterprise Linux 5:

perl daysofrisk.pl --cpe enterprise_linux:5 --severity C
      

Sample reports

You can use the daysofrisk.pl script to run sample reports based on the above data sources. The following are pregenerated examples:



Distribution

Dates

Severity

Metrics

Red Hat Enterprise Linux 3 (all packages)

20031022-20101031

All dates
Critical flaws

179 vulnerabilities
Average is 2 days
Median is 1 day
87% were within 1 day

Red Hat Enterprise Linux 4 (all packages)

20050215-20110131

All dates
For all flaws regardless of severity

1786 vulnerabilities
Average is 79.7 days
Median is 14 days
34% were within 1 day

Red Hat Enterprise Linux 4 AS (default installation packages)

20050215-20110131

All dates
Critical flaws

62 vulnerabilities
Average is 0.5 day
Median is 0 day
96% were within 1 day

Red Hat Enterprise Linux 5 Server (default installation packages)

20070314-20110131

All dates
For all flaws regardless of severity

897 vulnerabilities
Average is 80.9 days
Median is 9 days
44% were within 1 day

Red Hat Enterprise Linux 5 (all packages)

20070314-20110131

All dates
Critical flaws

168 vulnerabilities
Average is 0.6 day
Median is 0 day
97% were within 1 day

Other analysis

  • Risk report: Five years of Red Hat Enterprise Linux 4 [PDF]: This whitepaper looks at the state of security for the first 5 years of Red Hat Enterprise Linux 4, from its release on February 15, 2005. It includes metrics, key vulnerabilities, and the most common ways users were affected by security issues.

  • Mark Cox metrics weblog: Mark Cox, director of the Red Hat Security Response Team, publishes a weblog with insight into security measurement and metrics for Red Hat products.