07 - References and Further Reading

To continue expanding your knowledge on vulnerability management and risk prioritization, explore the following authoritative resources and frameworks.

Threat Intelligence & Scoring

• FIRST EPSS (Exploit Prediction Scoring System)
  • Home: https://www.first.org/epss/
  • API Documentation: https://www.first.org/epss/api
• CISA Known Exploited Vulnerabilities (KEV) Catalog
  • Webpage: https://www.cisa.gov/known-exploited-vulnerabilities-catalog
  • JSON Data Feed: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
• FIRST CVSS (Common Vulnerability Scoring System v4.0)
  • Specification: https://www.first.org/cvss/v4.0/

Standards & Frameworks

• NIST Special Publication 800-40 Revision 4
  • Guide to Enterprise Patch Management Planning: https://csrc.nist.gov/publications/detail/sp/800-40/rev-4/final
• NIST Special Publication 800-115
  • Technical Guide to Information Security Testing and Assessment: https://csrc.nist.gov/publications/detail/sp/800-115/final

Tooling & Software

• OpenVAS / Greenbone Vulnerability Management
  • Documentation: https://www.greenbone.net/en/
• Tenable Nessus
  • Website: https://www.tenable.com/products/nessus

Security Community

• OWASP Vulnerability Management Guide
  • OWASP provides vast resources on Application Security and managing software defects: https://owasp.org/