Gegroet

just a quick note on VM.

Google is now offering Google Blog Search Beta and I thought it interesting to see who is blogging on vulnerability management.Some of the output includes:

i) "Vulnerability Management" = 6,330 hits

ii) "Vulnerability Management" + Dummies = 314 hits

iii) "Vulnerability Management" + ineffective = 16 hits

iv) "Vulnerability Management" + effective = 314

Probably 90% of all hits came from vendors and it was also evident that they were punting the "successes" of VM, utilising their products and services.

It was also interesting to note how popular the Qualys "Vulnerability Management for Dummies" is, hence my search in that regard: 314 hits. Note corresponding hits for "VM + Effective". What Qualys has done is to punt effective VM without leaning too much towards their own solutions. The reference is however there and without a real contender in this space they obviously have the lead.

For infosec guys that need to kick-start a VM process in their companies there is not a lot to lean on apart from product punts and associated solutions.  It also requires access to research companies such as Gartner and Burton Group to really get solid information - at a price of course. This obviously leaves a gap for people to post or publish really effective and non-partisan VM research and ideas.

Evert.