If you cannot measure it, you cannot manage it- Peter Drucker
Here is a RSS feed/website for all security incidents
http://www.us-cert.gov/current/ and http://www.us-cert.gov/cas/techalerts/
You can also see http://www.onguardonline.gov/tools/overview.aspx for tools to be secure online.
But the new measuring system is http://cwe.mitre.org/cwss/ to help being secure. It basically creates a score or an anlytical approach for measuring vulnerabilities.
Common Weakness Scoring System (CWSS)
The Common Weakness Scoring System (CWSS) provides a mechanism for scoring weaknesses in a consistent, flexible, open manner while accommodating context for the various business domains. It is a collaborative, community-based effort that is addressing the needs of itsstakeholders across government, academia, and industry. CWSS is a part of the Common Weakness Enumeration (CWE) project, co-sponsored by the Software Assurance program in the National Cyber Security Division (NCSD) of the US Department of Homeland Security (DHS).
- provides a common framework for prioritizing security errors (“weaknesses”) that are discovered in software applications
- provides a quantitative measurement of the unfixed weaknesses that are present within a software application
- can be used by developers to prioritize unfixed weaknesses within their own software
- in conjunction with the Common Weakness Risk Analysis Framework (CWRAF), can be used by consumers to identify the most important weaknesses for their business domains, in order to inform their acquisition and protection activities as one part of the larger process of achieving software assurance.
and the top 25 errors in software are
||Improper Neutralization of Special Elements used in an SQL Command (‘SQL Injection’)
||Improper Neutralization of Special Elements used in an OS Command (‘OS Command Injection’)
||Buffer Copy without Checking Size of Input (‘Classic Buffer Overflow’)
||Improper Neutralization of Input During Web Page Generation (‘Cross-site Scripting’)
||Missing Authentication for Critical Function
||Use of Hard-coded Credentials
||Missing Encryption of Sensitive Data
||Unrestricted Upload of File with Dangerous Type
||Reliance on Untrusted Inputs in a Security Decision
||Execution with Unnecessary Privileges
||Cross-Site Request Forgery (CSRF)
||Improper Limitation of a Pathname to a Restricted Directory (‘Path Traversal’)
||Download of Code Without Integrity Check
||Inclusion of Functionality from Untrusted Control Sphere
||Incorrect Permission Assignment for Critical Resource
||Use of Potentially Dangerous Function
||Use of a Broken or Risky Cryptographic Algorithm
||Incorrect Calculation of Buffer Size
||Improper Restriction of Excessive Authentication Attempts
||URL Redirection to Untrusted Site (‘Open Redirect’)
||Uncontrolled Format String
||Integer Overflow or Wraparound
||Use of a One-Way Hash without a Salt
You can use the list at http://cwe.mitre.org/top25/index.html and check your own corporate vulnerabilities. It is better to sweat in cyber peace than bleed in cyber war, huh.