internet security tHreAt rePOrt GOVernMent 2013

p. 138
Symantec Corporation
Internet Security Threat Report 2013 :: Volume 18
VULNERABILITy TRENDS
Total Number of Vulnerabilities
Background
The total number of vulnerabilities for 2012 is based on research
from independent security experts and vendors of affected
products. The yearly total also includes zero-day vulnerabilities
that attackers uncovered and were subsequently identified
post-exploitation. Calculating the total number of vulnerabilities
provides insight into vulnerability research being conducted in
the threat landscape. There are many motivations for conducting
vulnerability research, including security, academic, promotional,
software quality assurance, and, of course, the malicious
motivations that drive attackers. Symantec gathers information
on all of these vulnerabilities as part of its DeepSight
vulnerability database and alerting services. Examining these
trends also provides further insight into other topics discussed in
this report.
Discovering vulnerabilities can be advantageous to both sides
of the security equation: legitimate researchers may learn
how better to defend against attacks by analyzing the work of
attackers who uncover vulnerabilities; conversely, cybercriminals
can capitalize on the published work of legitimate researchers
to advance their attack capabilities. The vast majority of
vulnerabilities that are exploited by attack toolkits are publicly
known by the time they are exploited.
Methodology
Information about vulnerabilities is made public through
a number of sources. These include mailing lists, vendor
advisories, and detection in the wild. Symantec gathers
this information and analyzes various characteristics of
the vulnerabilities, including technical information and
ratings in order to determine the severity and impact of the
vulnerabilities. This information is stored in the DeepSight
vulnerability database, which houses over 52,795 distinct
vulnerabilities spanning a period of over 20 years. As part of
the data gathering process, Symantec scores the vulnerabilities
according to version 2.0 of the community-based CVSS (Common
Vulnerability Scoring System). 1 Symantec adopted version 2.0 of
the scoring system in 2008. The total number of vulnerabilities
is determined by counting all of the vulnerabilities published
during the reporting period. All vulnerabilities are included,
regardless of severity or whether or not the vendor who produced
the vulnerable product confirmed them.