A security technician wants to learn about the latest zero-day threats and newly discovered vulnerabilities but does not have the budget to purchase a commercial threat intelligence service. Which…

Question

Options

• ASocial media platforms
• BConferences and local community security events
• CSoftware vendor threat reports
• DRSS feed from reputable security bloggers
• ERegional CERT
• FWhite papers and journal articles

• A
  3% (1)
• B
  8% (3)
• C
  3% (1)
• D
  88% (35)

Explanation

RSS feeds from reputable security bloggers (D) provide near-real-time, practitioner-level analysis of newly discovered vulnerabilities and active zero-day threats from credible, specialized sources (e.g., Project Zero, Krebs on Security, Schneier on Security) at no cost. Regional CERTs (E) (Computer Emergency Response Teams, such as US-CERT/CISA, CERT/CC, or regional equivalents) are government or quasi-government bodies that publish authoritative, free advisories, alerts, and technical details on current threats and vulnerabilities with high credibility. Social media (A) is unreliable and noisy. Conferences (B) are periodic and not suited for ongoing intelligence. Software vendor reports (C) are often biased and backward-looking. White papers and journal articles (F) are valuable for deep research but are too slow to publish for zero-day and newly discovered vulnerability intelligence.

No community discussion yet for this question.