Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

I'm looking for an updated and comprehensive guide of general/common IT vulnerabilities (general information).

I do not want you to do the job for me, I just want to point me in the right direction: a book or website recommendation would be great.

There is a wealth of information available from the Google search engine, but I can not recognize what information is valuable.

share|improve this question
    
It´s my first question here, so I don´t have enough privileges to upvote the great answers of @VirtuosiMedia, @Tate Hansen and @bretik. And choosing just one answer seems a bit unfair... it will be great to merge all this answers. –  Edgar Nov 19 '10 at 7:28
add comment

6 Answers 6

up vote 7 down vote accepted

Check out the security benchmark/checklist resources from:

http://cisecurity.org/
The Center for Internet Security (CIS) is a non-profit enterprise whose Benchmarking and Metrics Division helps organizations reduce the risk of business and e-commerce disruptions resulting from inadequate technical security controls. The Division provides enterprises with consensus best practice standards for security configurations, as well as resources for measuring information security status and for making rational decisions about security investments.

http://iase.disa.mil/stigs/checklist/
Defense Information Systems Agency (DISA)

http://web.nvd.nist.gov/view/ncp/repository
http://csrc.nist.gov/fdcc/faq-common_security_configurations.html The National Checklist Program (NCP), defined by the NIST SP 800-70 Rev. 1, is the U.S. government repository of publicly available security checklists (or benchmarks) that provide detailed low level guidance on setting the security configuration of operating systems and applications.

Running through a few checklists that pertain to your environment can give you a quick idea of things to watch out for.

share|improve this answer
    
the first site is very interesting, it has an "52 best practice Benchmarks for security configuration of operating systems, applications, and devices." And it´s free. Great. Downloading... –  Edgar Nov 19 '10 at 7:19
add comment

It's not exactly a guide, but I believe CWE - Common Weakness Enumeration is excellent source of common software vulnerabilities (not just web) and it is up to date. And of course for web application, the OWASP site contains a lot of useful information about web application vulnerabilities.

share|improve this answer
1  
OMG, I post this question in StackOverflow a few days back, no answers, no comments, and now, you guys gave me a great list of sites and resources in exactly the way I needed. Thanks. –  Edgar Nov 19 '10 at 7:22
add comment

The main four to look at (depending on what types you're interested in), some of these have been mentioned:

share|improve this answer
add comment

Check out OWASP. It's not exactly a general resource as it is geared for web application security, but it's a valuable resource for anyone making a web app or web site. Specifically, you might find their Top 10 list useful.

share|improve this answer
    
you are right, the site is worthy and the top 10 list is a very good starting point for further searching. Thanks. –  Edgar Nov 19 '10 at 7:13
add comment

I use this link : http://www.cvedetails.com

to search for vulnerabilities to any product

share|improve this answer
add comment

In my opinion, knowing specific software vulnerabilities is not as much helpful for improving the security of your organization as performing a full IT risk assessment. After the risk assessment you will be able to evaluate, in a more objective way, if the main problem for your IT infrastructure are the software vulnerabilities, the phisical security, the people, the procedures or other elements.

There exist multiple methodologies and frameworks to perform risk assessments Magerit, OCTAVE, Mehari and others.

Here, in Spain, Magerit is very used because it is supposed that public administrations must use it in order to identify and be able to reduce the risks for the organization. Magerit includes a catalogue of threats that can be used as a "comprehensive guide of general/common IT vulnerabilities" as you ask in your question.

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.