Becoming A CNA—Myths versus Facts

Host Shannon Sabens of CrowdStrike chats with Julia Turkevich of the U.S. Cybersecurity and Infrastructure Security Agency (CISA) about the myths and facts of partnering with the CVE Program as a CVE Numbering Authority (CNA) . Truth and facts about the following myths are discussed: Myth : Only a specific category of software vendors can become CNAs. Myth : Organizations cannot leverage their existing vulnerability management and disclosure processes when they become a CNA. Myth : The requirements for becoming a CNA are overwhelming and extensive. Myth : A fee is required to become a CNA. Myth : The CNA onboarding process is too complicated and time-consuming. Myth : Organizations cannot choose the Top-Level Root or Root they want to work with. The purpose and overall structure of the CVE Program and CISA's role in recruiting and managing CNAs within its Top-Level Root scope of industrial control system (ICS) and operation technology (OT) are also discussed. LINKS: How to Become a CNA CNA Onboarding Process Overview CVE Program Structure CISA ICS Top-Level Root partner details page List of CVE Program Partners

You can listen to Becoming A CNA—Myths versus Facts online on Radio and Podcast. Open the player on this page to stream the available audio.

Becoming A CNA—Myths versus Facts is an episode from We Speak CVE by CVE Program.

This episode is 22:25 long.

This episode was published on Jun 21, 2023.

Yes. Use the heart button on the episode page to add it to your favorite episodes list.

Yes. This page shows related episodes from We Speak CVE when more episodes are available from the podcast feed.