Are there any non-Forbes sources that confirm this?
> However, in an updated statement, the agency revealed it intends to maintain the database in a bid to prevent a lapse in CVE services.
> “The CVE Program is invaluable to the cyber community and a priority of CISA,” a spokesperson said.
> “Last night, CISA executed the option period on the contract to ensure there will be no lapse in critical CVE services. We appreciate our partners’ and stakeholders’ patience.”
Searching for that last passage:
https://www.bleepingcomputer.com/news/security/cisa-extends-...
> "The CVE Program is invaluable to cyber community and a priority of CISA," the U.S. cybersecurity agency told BleepingComputer. "Last night, CISA executed the option period on the contract to ensure there will be no lapse in critical CVE services. We appreciate our partners' and stakeholders' patience."
And https://www.reuters.com/world/us/us-agency-extends-support-l...
> WASHINGTON, April 16 (Reuters) - U.S. officials have said at the last minute that they're extending support for a critical database of cyber weaknesses whose funding was due to run out on Wednesday.
> The planned lapse in payments for the MITRE Corp's Common Vulnerabilities and Exposures database spread alarm across the cybersecurity community. The database, which acts as a kind of catalog for cyber weaknesses, plays a key role in enabling IT administrators to quickly flag and triage the myriad different bugs and hacks discovered daily.
I don't believe it was a mistake - they wanted to pull its funding (and still intend to do). Note the wording of the statement:
> Last night, CISA executed the option period on the contract to ensure there will be no lapse in critical CVE services.
We are now in the option period.
At some point in the future, that option period will expire.
https://www.cisa.gov/news-events/directives/bod-22-01-reduci...
A binding operational directive is a compulsory direction to federal, executive branch, departments and agencies for purposes of safeguarding federal information and information systems.
Section 3553(b)(2) of title 44, U.S. Code, authorizes the Secretary of the Department of Homeland Security (DHS) to develop and oversee the implementation of binding operational directives.
Federal agencies are required to comply with DHS-developed directives.
...
Remediate each vulnerability according to the timelines set forth in the CISA-managed vulnerability catalog. The catalog will list exploited vulnerabilities that carry significant risk to the federal enterprise with the requirement to remediate within 6 months for vulnerabilities with a Common Vulnerabilities and Exposures (CVE) ID assigned prior to 2021 and within two weeks for all other vulnerabilities. These default timelines may be adjusted in the case of grave risk to the Federal Enterprise.
Assuming this is the correct contract, which it appears to be, it had an option period starting today through March of next year. DHS just needed to exercise the option.
Supposedly, MITRE will make a statement today. Time will tell.
Edit - it is MITRE, not CISA, which the poster expects to make a statement.
Metacurity’s post was like 90 minutes ago.
https://old.reddit.com/r/netsec/comments/1k0dodx/mitre_suppo...