After some comments made to another question, I wonder how many administrators actually go to websites like Packetstorm? Do you keep up to date with the latest threats coming out? Finally what are the best resources to keep you feeling all safe (or frightened) inside?
closed as off-topic by HopelessN00b Jan 21 '15 at 18:41
This question appears to be off-topic. The users who voted to close gave this specific reason:
- "Requests for product, service, or learning material recommendations are off-topic because they attract low quality, opinionated and spam answers, and the answers become obsolete quickly. Instead, describe the business problem you are working on, the research you have done, and the steps taken so far to solve it." – HopelessN00b
locked by HopelessN00b Jan 21 '15 at 18:42
This question exists because it has historical significance, but it is not considered a good, on-topic question for this site so please do not use it as evidence that you can ask similar questions here. This question and its answers are frozen and cannot be changed. See the help center for guidance on writing a good question.
Read more about locked posts here.
Someone else mentioned SecurityFocus, but for more general security related issues (not specific to IT), I recommend Schneier on Security. His blog touches on IT security, but also on other security topics as well. I find that some of the more general issues he discusses helps me to be more aware of security in general, which carries over into IT operations.
Honestly, the main thing I do is keep current on patches, including being on the announce/security mailing list for any software I install that's not from the main OS vendor.
Anything else starts falling onto the "more effort than it's worth" side of the cost vs. benefit analysis. I could do my own custom patch, but I'm more likely to break something than if I wait for the vendor to release a tested update.
There's always new threats. Do you really have the time to keep up with every one of them? Do you even care if you're not running the program in question in the affected configuration?
Concentrate on providing the smallest attack surface you can, along with the smallest reasonable attack window. In other words: only run what you need to, firewall everything you can, and keep current on patches.
SecurityFocus has one big vulnerability database classified by vendor and product. You can also purchase Symantec DeepSight Alert Services where you can select whcich software do you have and several methods for vulnerabilities notifications.
There is a complementary service by Symantec (Threat Alert) which notifies about global security threats.
In the same sort of line, you can use (and contribute to) OSVDB (Open Source Vulnerability Database).
If you want to know about security tools I find darknet very useful.
US-CERT puts out a weekly vulnerability summary. It's pretty comprehensive, and it usually takes only a few minutes to skim it. You can subscribe via e-mail or RSS...
I track a several security focused resources, my favorites being Schneier and the Internet Storm Center (part of SANS). Unfortunately, the longer I read Schneier, the more I find myself thinking, ‘Yeah, but....’ after reading an entry. That being said, he makes an incredible cryptographer, and can certainly help you think with security in mind. Dark Reading is another good resource for the security analyst, but will likely be hit/miss for general IT workers.
Otherwise, do what everybody else seems to be mentioning; subscribe to the patch or announce list for anything you use vendor or otherwise. I subscribe to the Secunia mailing list to keep a general eye on what's coming through. Roughly once a week we are asking the SysAdmins whether or not the patches have been applied from vulnerabilities advertised through Secunia.
It really depends on how interested in security you are. Are you just wanting to monitor for when assets you have in house have security issues? Or do you really like security?
You can also check out Project Quant for a list of the process for monitoring for advisories: http://securosis.com/projectquant/details-monitor-for-advisories
Someone recently compiled a good list of over 100 security related RSS feeds: exoticliability.com/forum/topics/list-of-feeds-for-infosec
I'll also shamelessly plug the OSVDB (Open Source Vulnerability Database), a project of the Open Security Foundation. It's a great place to get vulnerability information combined from a variety of sources (milw0rm, Bugtraq, secunia, CVE, etc.)