Steve Christey Coley

About Steve Christey Coley

I am a Principal Information Security Engineer in the Cyber Security Division at The MITRE Corporation, supporting the FDA CDRH on Medical Device Cyber Security. I like changing my last name every two decades or so. With cybersecurity experience dating back to 1993, I was the co-creator and Editor of the Common Vulnerabilities and Exposures (CVE) list and chair of the CVEEditorial Board from to 2015. I am the technical lead for the Common Weakness Enumeration (CWE), Common Weakness Scoring System (CWSS), and the community-driven CWE/SANS Top 25 Software Most Dangerous Software Errors. I am not the Cavalry but am Cavalry-adjacent. I was a co-author of the influential \"Responsible Vulnerability Disclosure Process\" IETF draft with Chris Wysopal in 2002. I was an active contributor to other efforts including the Common Vulnerability Scoring System (CVSS) version 2, the Common Vulnerability Reporting Framework (CVRF), NIST\'s Static Analysis Tool Exposition (SATE), certain non-public projects involving the assessment of static code analysis tools, and the SANS Secure Programming exams. My current interests include ensuring that emerging technologies do not repeat the chaotic path to effective vulnerability management that occurred with enterprise IT in the 1990s, especially in healthcare; secure software development and testing; consumer-friendly software security metrics; the theoretical underpinnings of vulnerabilities; developing analogies between epidemiology and information security (e.g. within vulnerability statistics); improving the exchange of vulnerability information across global regions, language boundaries, emerging industries, and newly-connected technical domains; and making the cybersecurity profession more inclusive, diverse, and accessible to everybody who seeks a place in it. I have a B.S. in Computer Science with a minor in Sociology from Hobart College.Specialties: Vulnerability research, vulnerability management, software security.

Experience

1. Principal Information Security Engineer

   MITRE

   Dec 1989 — Present

Education

• Hobart and William Smith Colleges

  BS

  1985 — 1989

Skills

• Network Security
• Computer Security
• Security Research
• Information Security Management
• Diversity & Inclusion
• Vulnerability Assessment
• Malware Analysis
• Vulnerability Management
• Vulnerability Scanning
• Nist
• Application Security
• Vulnerability
• Security
• Information Security
• Vulnerability Research
• Web Application Security