Hi Problem with benchmarking the vulnerability providers

Oh man! Ad-blocking software has been detected! :'(

This website is run by the community, for the community... and it needs advertisements in order to keep running. Blocking our ads means your killing our stats!
Please disable your ad-block, or become a premium member to hide all advertisements and this notice.

Hi guys ,
My name is Dhruva Kumar .I ám from india. Presently doing my Msc in germany .
I have a task which is to benchmark the vulnerability information providers .
I am not able to start my task my task since i am new this field of IT security . I need to benchmark these providers (for ex secunia , debian etc)based on the acutality , timliness , information content provided by these providers . Is there any website where i can get relevant information on this topic
regards
darshan

 

Oh man! Ad-blocking software has been detected! :'(

This website is run by the community, for the community... and it needs advertisements in order to keep running. Blocking our ads means your killing our stats!
Please disable your ad-block, or become a premium member to hide all advertisements and this notice.

Hi there darshan,

If I understand you correctly what you are trying to do is determine the amount of time it takes providers to patch a vulnerability in their software from its discovery?

I'm not aware of any website that would provide these statistics, but surely the amount of time it takes would be dependant on the nature of the 'hole'?

 

thank u very much for ur reply
what u r saying is right it depends on the flaws present in the software ,

my task is not concerned with these flaws but with the providers
i need to create a benchmarck for selecting these providers based on how quick they distribute the patch or the advisory, the infromation provided by them is well understood by the analysis team or not, will they provide option to automatically store these information in database . i hope i am clear this time

my problem is how can i start with this benchmarking process
regards

 

Not sure if these links are of any use to you, but they discuss the process of releasing patches (I only just scanned them, so they may be completely irrelevant).

http://www.cylab.cmu.edu/default.aspx?id=297

http://infosecon.net/workshop/pdf/telang_wattal.pdf

Another place for you to try could be the vendors own forums. This way you may actually get the people that produce the software discussing the process.

Sorry I can't be of any more help.

 

thats ok i will just go thru these links
also i will check the forums of the vendors i think thats good idea
thank u very much