Effective Vulnerability Management

6Vulnerability and Exploit Database Management

Vulnerability and exploit databases play a fundamental role in the conversation surrounding vulnerability management. At a high level, a vulnerability database can be described as an effort to collect information about known security flaws in software and products, and then make that information available either publicly or to some community of users. Some vulnerability databases have been around for many years, while others are new and starting to gain increased use in the technology and cybersecurity community. Exploit databases are collections of public exploits, used for research and to aid practitioners and defenders. In this chapter, we discuss some of the most notable examples, as well as their challenges and strengths and how they can be used by both vulnerability management vendors and end-user organizations.

National Vulnerability Database (NVD)

Vulnerabilities help inform activities to drive down risk, both for organizations creating and producing software as well as those using and consuming it and providing broad industry knowledge of the vulnerabilities present in the ecosystem.

While there are several vulnerability databases in the industry, one of the most notable examples is the National Institute of Standards and Technology's National Vulnerability Database (NVD). NVD is a comprehensive cybersecurity vulnerability database that integrates all publicly available U.S. government vulnerability resources and provides ...