McAfee AVERT Joins Common Malware Enumeration's Editorial Board
IT News Online Staff
2005-10-05
McAfee Inc. has announced that McAfee AVERT, its Anti-Virus and Vulnerability Emergency Response Team, has joined the Common Malware Enumeration (CME) initiative as a member of its Editorial Board. The CME initiative is headed by the United States Computer Emergency Readiness Team (US-CERT) to promote the adoption of a neutral, shared identification method for naming malware.
McAfee AVERT will help bring the CME's concept to maturity as well as help expand its reach to other members of the anti-malware industry.
The CME initiative is designed to reduce the public's confusion in referencing threats during malware incidents, enhance communications between anti-virus vendors and improve information sharing among the information security community. The effort is fashioned similarly to the Common Vulnerabilities and Exposures (CVE) initiative, which is also operated by MITRE in support of US-CERT for standard naming around all publicly known vulnerabilities.
McAfee, which is a member of both initiatives, said it joined the CME to demonstrate its support and commitment to helping the industry alleviate the problems surrounding current naming conventions.
"During the outbreak process it can be difficult for anti-virus companies to stay coordinated with virus names, and, as a result, threats are given a variety of names and variant designations," said Jimmy Kuo, research fellow, McAfee AVERT. "This is even harder on IT administrators, because their products may be alerting them to threats with completely different names than what another security vendor may be calling them. The CME initiative will help alleviate this problem with the use of identifiers, so even if a name is slightly different between various vendors, the identifier will match."
As a member of the CME initiative, McAfee will share its samples with the CME during an outbreak with as much information about the threat as possible. McAfee will automatically receive a CME identifier for the threat, which is also automatically shared with other participants of the CME. All participants are then expected to disseminate the CME identifier as quickly as possible to the entities it regularly communicates with, including any press it might be speaking to.
In addition, McAfee said it would reference the identifier information on its virus information library located on the McAfee Web site (vil.nai.com), so that users could search for a threat by its identifying number as well as the virus name.
|
