Kaspersky unveils new data feed to detect industrial vulnerabilities – Times of India

Kaspersky recently launched a new machine-readable Open Vulnerability and Assessment Language (OVAL) data feed for automated detection of vulnerabilities in operating technology (OT) software. According to the company, the Kaspersky Industrial OVAL Data Feed for Windows delivers comprehensive intelligence about vulnerabilities in most popular SCADA and distributed control systems (DCS) based on data from multiple sources, analysed and updated by Kaspersky experts, as well as instructions for mitigation. The feed is delivered in XML format for integration with vulnerability management solutions which support the OVAL standard.
Kaspersky says that the number of vulnerabilities discovered in industrial automation software is substantial and raises concern. The cybersecurity company cites the case of the National Vulnerability Database which is said to contain thousands of known vulnerabilities in popular software used in automation, manufacturing execution and distributed control systems, and many more recordings of known vulnerabilities in various industrial software solutions.

Kaspersky claims that the Industrial OVAL Data Feed for Windows applies OVAL specifications dedicated to the standardised transfer of vulnerability information across various security tools and services. As per the company, it will help industrial organizations in enhancing vulnerability detection and assessment of SCADA and other OT software.

The product is integrated into a customer’s industrial vulnerability management solution and can be used with open-source OVAL interpreters. It is claimed to provide detailed information about detected flaws, their description, affected software name and versions, severity score and metrics (CVSS), and it also recommends measures for mitigation.
According to Kaspersky, the feed covers products from the world’s leading vendors such as Siemens, Schneider Electric, Yokogawa, Emerson and more.