Vulnerability management vendor Rapid7 has launched a new community-driven platform that allows security professionals to exchange information about emerging flaws to better understand their impact and determine likelihood of those vulnerabilities being exploited by attackers.
Called AttackerKB, the platform was launched as a closed beta program in January and was opened to the public April 15. An open API will make the data available automatically to other services and tools that enterprise security teams use.
"We heard a lot from members of the community, whether they are contributors to the Metasploit Framework [the popular open-source penetration testing tool maintained by Rapid7] or penetration testers that are also part of that community, who said: 'Look, we don't have a place where we can start to really try to boil down which of these vulnerabilities are valuable for attackers, as well as the associated high impact that remediators can get from resolving some vulnerabilities'," Cindy Stanton, vice president for vulnerability and risk management at Rapid7 tells CSO.
It's an attempt to add a level of context around vulnerabilities being published, so that people can get that signal-to-noise ratio and a better place where they can ask, “Is this vulnerability truly important or not that important?” so they can go to their remediation teams with confidence, she says.
Not all vulnerabilities are created equal
When vendors publicly disclose vulnerabilities and patch notes in security advisories, they receive a severity score based on an industry standard called the Common Vulnerabilities Scoring System (CVSS). While these scores help defenders prioritize patches and are widely used ..
Support the originator by clicking the read the rest link below.
