Data Sources

For our AI4Cyber platform, we need IoT data showing us the different vulnerabilities that exist on IoT devices and application source codes used by several Telecoms providers like us.

We have identified the following data sources that can provide us the vulnerabilities and remediations to them. Using our AI4Cyber platform, we will be able to proactively identify does that will match with our asset inventory and automate the remediation if possible.

What is NVD?

The National Vulnerability Database (NVD) is the U.S. government repository of standards-based vulnerability management data represented using the Security Content Automation Protocol (SCAP).

Is NVD aiding with Tactical or Strategic focuses?

The NVD will help develop our tactical approach through enabling automation of vulnerability management, security measurement, and compliance.

What is the Quality and Relevance of NVD?

NVD includes databases of security checklists, security related software flaws, misconfigurations, product names, and impact metrics. NVD supports the Information Security Automation Program (ISAP). There is, however, a 7-day median lag between a CVE2 being revealed to ultimately being published to the NVD; and 75% of vulnerabilities are published unofficially before making it to the NVD. In addition to providing a list of Common Vulnerabilities and Exposures (CVEs), the NVD scores vulnerabilities using the Common Vulnerability Scoring System (CVSS) which is based on a set of equations using metrics such as access complexity and availability of a remedy.

Is NVD Data Accessible?

The NVD now offers a new interface for organizations to use to query and ingest Vulnerability data. This new CVE/CPE API is intended to serve as an alternative to the legacy SOAP vulnerability data feed files the NVD has offered in the past.

What is GitHub?

GitHub is Git repository hosting service for source code version control management and collaboration.

Is GitHub aiding with Tactical or Strategic focuses?

GitHub will be assisting with both tactical and strategic focuses. For tactical, it will be identifying what may be relevant repositories for additional analysis. For strategic, it can give insight into who is sharing code publicly, what languages are they coding in, and which vulnerabilities might be affecting their code. This will be helpful for allocating resources for training and R&D.

What is the Quality and Relevance of GitHub?

GitHub data for the purposes of identifying relevant public repos is quite high due to GitHub’s robust search features. It is relevant because it helps us identify code that may be sensitive itself, have sensitive secrets (e.g., API Keys), or give attackers insight into the internals of the 5G network or technology ecosystem (e.g., IoT devices).

Is GitHub Data Accessible?

The searchable data is easily accessible by utilizing the public GitHub API.

What is Shodan?

Shodan is a search engine of service banners for Internet-connected devices. Which can be used for Network Security and Cyber Risk Analysis.

Why Are We Using Data from Shodan?

Shodan will help develop our tactical approach by identifying which assets are exposed on the public internet.

Shodan will show current data of assets in real time by 24/7 scanning and collection of data on approximately 500 million Internet-connected devices each month and archives this data in a search engine. Shodan is relevant to our chosen focus as much of the research conducted in 5G involves IoT devices and database servers that are connected to the internet.

The IoT provides multiple ways for attackers to access and manipulate connected devices on 5G networks. For example, encryption vulnerabilities in 5G’s standardized authentication and key agreement (AKA) protocol provide a backdoor for attackers, enabling mobile network mapping (MNmap). MNmap is a technique used by attackers to identify devices on a network and allows cyber criminals to “case the joint,” for example, by pinpointing the location of security devices on a network and circumventing them. Using data collected from Shodan we will be able to do the following:

• Identify other service provider IoT devices that are vulnerable and have maybe been put offline because of compromises. We can then compare the device types with those on our network for identification and remediation.
• Identify devices that have default ports running applications.

Is Shodan Data Accessible?

The searchable data is easily accessible by utilizing the public Shodan Application Programming Interface (API).