Information Security Stack Exchange is a question and answer site for information security professionals. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

What resources exist to research data on actual security incidents?

I would prefer an online resource but offline resources are acceptable. The cost of access should be less than $100 (US) for access to a statistically significant number of incidents. I would prefer databases that include more than just media reported security incidents.

I know of one online database RISI but a membership there is $995 (US) for 3 month access to their database. Are there similar databases at a lower cost?

share|improve this question
Is it the raw data you are after? Not things like Verizon's DBIR? – Rory Alsop Jul 15 '11 at 19:54
@Rory at the moment anything is better then nothing. Raw data is better but group data is fine. – this.josh Jul 15 '11 at 20:03
up vote 6 down vote accepted

My group has often used the OSF DataLoss DB for some comparative statistical analysis. By and large the data is gathered through public sources, either reported on the web or by issuing Freedom of Information requests to the various agencies that process breach notifications.

The real benefit is that this information is free, and made available as a downloadable database. As such post processing can go very nice and smooth.

share|improve this answer

Ones I tend to draw on:

Verizon Data Breach Report - this is generally considered THE source on data breaches

Krebs Java Security Report - Krebs is very well respected - various studies, of which this is a grand example

WHID Security Report - also very useful

These are all freely available online, and updated versions available annually (or more often in the case of Krebs)

share|improve this answer

It's more at the meta level of what happens the most, and doesn't cover specific incidents in detail, but every year the US gov't releases the Top 25 Dangerous Software Errors which references the Common Weakness Enumeration which is a break down of every know category of vulnerability.

2011's top 25 can be found here.

share|improve this answer
While that list is great for some purposes, it is a list of vulnerabilities rather than a list of breaches. If you want to find out what bad guys are actually exploiting or what failures are occurring in the field, a list of common vulnerabilities doesn't help much. – D.W. Jul 16 '11 at 5:38

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.