Converging Vulnerability Insights: Unifying Vulnerability Intelligence For Enhanced Application Security With Collaboration

The cyber threat landscape is ever evolving, and as technologies advance and grow, so do the vulnerabilities in software technologies, programming languages and software development frameworks. There is an imperative need to be able to preemptively counter emerging threats in software and applications, standalone or otherwise. There are several vulnerability intelligence tools and services available in the market, however they suffer from a single common drawback. The vulnerability intelligence they present depends on selective and even proprietary feeds of information. With software technology that is largely driven by community efforts, a much better solution is to present the vulnerability intelligence from the community driven vulnerability databases itself. Furthermore, vulnerability intelligence can also be utilized in the field of cyber forensics. Forensic investigators require a sound foundational knowledge of vulnerability insights and attack vectors to understand how an attack or an incident might have occurred. This paper presents a web-based vulnerability intelligence platform that can effectively leverage the OSV database, NVD, CAPEC and CWE to present a more comprehensive, community driven vulnerability intelligence that can not only help organizations in their vulnerability management efforts but also help cyber forensic analysts in getting relevant information about known attack methods in real time.