I liked D.W.'s answer so much I'm loathe to write another, but I had some points that were big enough that I'm unfortunately repeating here:
How do I - find out about a zero-day vulnerability against my application as soon as possible, without having to receive irrelevant notifications?
Get as close to the source of vulnerability disclosure as you can, and realize it won't always be the same source. That's going to have to be a combination of getting better at information-retrieval and making yourself easy to find (which has it's own spammy implications).
Good ideas include:
- have an obvious way on your site to include bugs and vulnerabilities
- make sure that when you are repackaged by any other system, part of the agreement is that bugs in security are sent to your bug/vulnerability tracking system. You'll probably want to discuss how issues are vetted before they are sent your way, but realize that often the biggest vulnerabilities are in how your system integrates with the bigger system.
- make sure vulnerability publication sites know how to find you - it won't fix a true "zero day" as they may lag behind by hours or days, but you definitely want to hear directly from them.
- collect as much information as you can relevant to potential product vulnerabilities - Google Alerts - was a great idea. I'm sure there are others.
You may need to accept that irrelevant information will come your way - the best you can do is sort it.
Keep in mind, as well, that not all vulnerabilities are found by the good guys. Waiting for someone else to find it is never the ideal way of finding vulnerabilities. As the product grows, you'll want to introduce some form of security verification, including things like:
- Code security analysis - both manual and automated.
- pen testing
- independant review
The level of effort needs to be balanced by the cost of error, here - but you may find that the cost of finding and responding to a vulnerability that gets disclosed in public is higher than implementing your own security verification.
How do I - Find out when vulnerability databases create entries related to my application?
Many of the vulnerability databases have streaming of alerts - you should be able to subscribe to a stream and filter or get an RSS feed and limit it with search criteria.
How do I - Ensure the accuracy of vulnerability database entries related to my application?
First - create a relationship with the database groups. And make it clear how to create a relationship with you if a database group is looking reach out. CERT's guidance, and this article - are great resources for recommendations, but the critical part is realizing that if they can't get to you, they won't get the right answer.
And it's a two way process - have a way to find you, but also find a way to publish information. And when you publish, include solid answers. As developer of solutions, I have too many run-arounds with solutions vendors who give security vulnerability information that sounds like they dreamed it up on the ride to work with no actual testing or factual information. List things like:
- specifics on the fix
- specifics on the testing used to verify the fix
- specifics on the impact of taking the fix (is there any chance something I was relying on will change or break?)
- general summary of the scope of the change - for example "fix made to an underlying utility function", "fix made to specalized code base used for XYZ interoperability, impact outside of this space is extremely limited"
And details of what CVE or other published issue you are trying to fix.
Put it up in as many streams as you can - email subscription, blog, website, etc. You want this to be findable.
And make your process known. If I submit a vulnerability to your website, can I expect to hear back in 24 hours? How do you rate severity? What is the process for resolution? If it's a product that is integrated in other solutions, who does the interop testing?
You don't need perfect metrics, you need to be able to live up to them. So, if your turnaround response time is 2 weeeks - let the users know that.