Nautobot Device Lifecycle Management – NIST CVE Tracking

Application: Nautobot Device Lifecycle Management Application

Application Version: Upgrade to Version 3.1.0

Feature: Automated NIST CVE Tracking for Software Versions

Acronyms:

CVE – Common Vulnerability and Exposures

DLM – Device Lifecycle Management Application

NIST – National Institute of Standards and Technology

NVD – National Vulnerability Database

What:

The Automated NIST CVE Tracking for Software Version feature is designed to help network teams enhance security vulnerability visibility. It automatically identifies and associates vulnerabilities with known software versions in Nautobot, saving time and improving efficiency.

Why:
Managing infrastructure with diverse equipment types means frequently dealing with software vulnerabilities. Vendors often provide email notifications for these vulnerabilities, but managing them can become cumbersome, especially with multiple platforms and versions. This complexity increases with more vendors, turning CVE tracking into a full-time job.

Currently, Nautobot’s Device Lifecycle Management app (DLM) offers CVE Object Tracking, but it requires the following manual steps:

1. Awareness of the CVE.

2. Manual entry of CVE data into DLM.

3. Associating the CVE with the relevant software.

This manual process contributes to technical security debt, as most organizations do not closely track CVEs, leaving many systems with known untracked vulnerabilities that could be leaving the infrastructure at risk.

Automated NIST CVE Tracking:

The new feature searches the NIST National Vulnerability Database, a unified source for CVE tracking that is regularly updated by software and hardware vendors. The DLM search checks the database for CVE entries associated with each software contained in Nautobot Software Versions. If there are any CVE entries associated with a software object, it ensures that the latest known version of the CVE data exists in Nautobot and that the Nautobot CVE Object is associated with the relevant Software.

Manually tracking and associating CVEs with the correct software can lead to oversights, especially as new vulnerabilities are reported. This Nautobot job searches the NIST NVD, automatically identifies the relevant CVEs, and ensures that they are properly recorded and linked to the appropriate software versions. By automating this process, it eliminates the risk of missing critical associations which open the network to attack, while saving engineers time and effort.

How:

During the installation of the 3.1.0 version (and beyond) of the Device Lifecycle Management Application, the following objects are created for you:

    – A new External Integration object named “NAUTOBOT DLM NIST EXTERNAL INTEGRATION”.

    – A new Secrets Group object named “NAUTOBOT DLM NIST SECRETS GROUP”.

    – A new Secret object named “NAUTOBOT DLM NIST API KEY”.  This object is created for you during setup with minimum defaults. The Secret name must be exactly as above, but you will need to configure the Secret to properly access the NIST API Key.

To gain an API key, the user must visit https://nvd.nist.gov/developers/request-an-api-key, complete, and submit the form provided.

The job will need to be enabled, and can then be scheduled or ran manually and will perform the following steps in order:

    – Obtain a full list of SoftwareVersion objects stored in Nautobot
    – Gather the URL(s) for the SoftwareVersion. These URLs are generated using the nist.py module located in the NTC Netutils library.
    –  With the gathered URL(s), query the NIST CVE Database for vulnerabilities related to the NIST API virtualMatchString parameter.

    – Use the data obtained to create or update all CVE objects in Nautobot and ensure they are associated with the proper SoftwareVersion(s).

NOTE: When running the job, you will be given the option to select the External Integration to use. You may select the NAUTOBOT DLM NIST EXTERNAL INTEGRATION object created during setup, or you may create your own External Integration and select it. Either way, the Integration must be configured to use the “NAUTOBOT DLM NIST SECRETS GROUP” object created during setup, and the “NAUTOBOT DLM NIST API KEY” Secret object (although possibly modified to meet your specific needs).

WorkFlow (Before and After):

SCREENSHOTS:

See Job in Jobs:

Select External Integration:

Job Results:

View from Software Version – Related CVEs Tab:

View of CVE created by the job: