Resources for Finding Information on New Vulnerabilities, Threats, and Countermeasures

Table A.2 is a list of Web sites to use when looking for information on new and old vulnerabilities and countermeasures. Each site has its own unique spin on security, and each is focused differently. Referencing two or three of these sites daily can be extremely helpful in keeping up-to-date with current security issues.

Table A.2. Security Information, News, and Updates

Description	Web Site Address
These sites are good for researching current threats and exploits, and recommended precautions and countermeasures.	http://www.cert.org/ http://www.incidents.org/ http://www.dshield.org/ http://www.infosecuritymag.com/
This is a searchable online DB of vulnerabilities and exploits. Searches can be performed by name, date, severity, source, and numerous other options.	http://icat.nist.gov
This is a good site for researching statistical information related to information security.	http://www.securitystats.com/
This site has the latest virus and worm-based threats.	http://www.mcafee.com/anti-virus/
This is a good site for free legitimate security tools.	http://www.foundstone.com/knowledge/free_tools.html
These sites are good sources for new vulnerabilities, exploits, and hacker tools.	http://www.insecure.org/index.html http://www.antionline.com/index.php
This is a paid subscription service for collaborating and sharing information about vulnerabilities, exploits, and countermeasures.	http://www.wwisac.com
These are good sites for system and device hardening.	http://www.yassp.org/ http://www.sun.com/solutions/blueprints/0100/security.pdf http://bastille-linux.sourceforge.net/ http://www.enteract.com/~robt/Docs/Articles/ip-stack-tuning.html http://www.auscert.org.au/Information/Auscert_info/papers.html http://www.cert.org/security-improvement/index.html http://www.trustedsystems.com/tss_nsa_guide.htm