Sources for Vulnerability and Threat Information

No matter which framework your organization uses to determine risks to information assets, understanding vulnerabilities and threats plays an integral role. With the sheer breadth of known vulnerabilities and (potential) threats, not to mention the ever-growing variants of identified malware, it’s important to narrow down information into a usable amount that can be used for risk analysis efforts. Your organization’s vulnerability and threat information needs may vary over time, but it’s good knowing that there are several sources available, including those described below. 

Start with Vulnerability Scanning 

Before you can start researching how to fix vulnerabilities in your system, you must identify which ones affect you. Ongoing vulnerability scanning provides a regular, automated review of your system that produces a report of known vulnerabilities you need to address ASAP. 

HBS recommends that you perform vuln scanning at least monthly. If selecting and managing a scanning tool sounds like more than your staff can handle, you can build vuln scans into an information security contract with a provider like HBS and let dedicated security analysts tailor your scans and review the results. 

Once you have a list of vulnerabilities present in your system, you can use the resources below to look up the vulnerability by name and learn best practices for remediating it. (When HBS reports scan results to clients, we reference the CVE ID for each vulnerability so that clients can go research the details. See the next section for a link to the CVE database.) 

We also recommend considering a Managed XDR solution, which brings next-gen threat detection and response to your environment. Managed XDR not only looks for known vulnerabilities, but uses artificial intelligence and machine learning to identify and shut down anomalous activity, providing additional protection against zero-day threats. 

Vulnerability Databases 

Two of the leading resources for understanding vulnerabilities are the National Vulnerability Database provided by NIST and the Common Exposures and Vulnerabilities (CVE) database, which is sponsored by the U.S. Department of Homeland Security and CISA. Both resources let you look up known vulnerabilities and learn from others about each vulnerability’s characteristics and remediations.  

Information Sharing and Analysis Centers (ISACs) 

The ISACs, organized through the National Council of ISACs, provide sector-specific threat and mitigation information for their member organizations. ISACs started to form after Presidential Decision Directive-63 was signed (May 1998), requesting that each critical infrastructure sector establish organizations for sharing information about threats and vulnerabilities. There are now 25 ISACs, covering a range of sectors, including healthcare, finances, retail, education, and emergency services, among others. This page provides a list of all the ISACs and their descriptions.  

Palo Alto Network Security Advisories 

Palo Alto’s site is another database that lets you perform detailed searches based on a vulnerability’s name, its severity, products it impacts, etc. 

United States – Computer Emergency Readiness Team (US-CERT) 

The US-CERT provides a variety of threat information, alerts and tips. This site from the Cybersecurity & Infrastructure Security Agency also provides information about product updates from companies such as Apple, Adobe, Cisco, and VM Ware. In addition, you can find information about other organizations that share vulnerability and threat information on the site. 

InfraGard 

The Federal Bureau of Investigation partners with members of the private sector to provide an information-sharing organization known as InfraGard, which focuses on protection of critical infrastructure. Chapters nationwide regularly hold InfraGard meetings to present and exchange information about vulnerabilities and threats applicable to national security. All members, regardless of the industry or company they represent, must undergo a background check prior to gaining access to the organization’s portal and meetings.  

SANS NewsBites 

This site from a well-known cybersecurity training provider describes itself as “a semiweekly executive summary of the most important cyber security news articles published recently. Each news item is annotated with important context provided by respected subject matter experts within the SANS community.” With a free membership, you receive access to the NewsBites newsletter, research, webcasts and more. 

CISCO Security Advisories 

Visit this site for updates on security issues related to one of the world’s leading networking platforms. 

Information Security Professional Associations 

Several industry associations focus specifically on information security, auditing, and risk. Association chapters provide great opportunities for networking with other information security professionals. Presentations and discussions at chapter meetings can be useful for maintaining awareness across myriad topics, including the latest threats and mitigations measures. This list from Cybercrime Magazine provides a useful list of groups around the country.  

Staying Alert 

No matter which sources you use, your risk analysis efforts can benefit by having multiple choices for vulnerability and threat information. Within our daily schedules, we may not always find time to stay abreast of the latest information, so it’s good to build in various vulnerability and threat assessment activities into your routine. To adequately determine risks, an organization must understand its vulnerabilities and potential threats.  

If you need help creating a plan for monitoring and remediating the risks in your environment, contact HBS to find out how our consultants can support your team.