Security Information Provider (SIP)

Security Information Providers (SIP) are the entities that monitor the security (and insecurity) scene. Nowadays, an exploit being published or spreading will be analyzed quickly and result in a disclosure of the corresponding vulnerability (e.g. a security advisory) The disclosure contains important technical and risk information to help the public to assess their individual risk and plan countermeasures. This argument also works the other side, vulnerabilities disclosed are analyzed by blackhats and exploits will follow quickly.

Source for the disclosure date

• x-axis: time from 1996 to 2007
• y-axis: number of disclosed vulnerabilities per day from 0 to 50 (cutoff)

To select a source for the disclosure date, we analyzed the disclosure dates published by the following security information providers: CERT, FrSirt, IBM ISS X-Force, Secunia, and SecurityFocus. These are the most referenced security information providers in the National Vulnerability Database NVD and Common Vulnerabilities and Exposures CVE databases. The following plots depict the number of security vulnerabilities disclosed by the respective Security Information Provider for the period 1996 to 2007.