[unisog] SANS Top 20

Chris Gundersen chrisg at techometry.com
Tue Feb 15 15:18:50 GMT 2005


I know that the Top 20 is really two Top 10's, but would it be a good idea
to provide not only a master list with all 20 vulnerabilities, but also a
separate one for each particular OS? That way, people in pure Windows
environments would only have to worry with the list of Windows
Vulnerabilities. I know it is trivial to segregate all the U* items from
the W* items in a single data file, but that might remove a level of
complexity for people wishing to automate processes using these data.

Perhaps a link for download that will either spit out the entire CVS file
or just Win or Unix vulnerabilities, depending on which link you click? A
little Perl can make that a reality in short order, depending on the
environment. I don't want to make things harder, and am certainly willing
to pound out some code towards this effort.

Just my two cents...

-Gunny

Leo Howell said:
> A CVS format would be a perfect world.  Looking at the Top-20 list on
> the site I think the following fields would be relevant:
>
> Top 20# | Description | Vulnerability # | Affected OS | Affected
> Services
>
> What say you all?
>
>
>
>>>> Valdis.Kletnieks at vt.edu 2/14/2005 3:44:17 PM >>>
>
> On Mon, 14 Feb 2005 11:53:22 EST, Leo Howell said:
>
>> Does anyone have a script, tool or some other method of converting
> the
>> SANS/FBI Top 20 List from the website to a tabular format such as
> that
>> below?
>>
>> E.g.
>> Top 20 #     Description                              Vulnerability
> #
>> W1             Web Servers & Services      CAN-2003-0812
>> W1             Web Servers & Services      CAN-2003-0813
>> W1             Web Servers & Services      CAN-2003-0352
>> W2             Workstation Service            CAN-2003-0812
>
> I don't have one handy, but if there's enough demand and a consensus of
> what
> fields are desired, I'll see if I can get a CSV-format thing included
> as
> part of this year's Top-20 (speaking not as a SANS person, but somebody
> who's
> done every one of them since the first top-10 except one year)....
>
> _______________________________________________
> unisog mailing list
> unisog at lists.sans.org
> http://www.dshield.org/mailman/listinfo/unisog
>


+----------------------
| Chris Gundersen
| chrisg at techometry.com
+----------------------

***********************
"The credit belongs to the man who is
actually in the arena, whose face is
marred by dust and sweat and blood;
who strives valiantly; who errs and
comes short again and again, who knows
the great enthusiasms, the great
devotions, and spends himself in a
worthy cause; who at best, knows the
triumph of high achievement;
and who, at the worst, if he fails,
at least fails while daring greatly,
so that his place shall never be
with those cold and timid souls
who know neither victory nor defeat."
             - Theodore Roosevelt



More information about the unisog mailing list