Method and apparatus for management of vulnerability disclosures

A system for managing vulnerability data, comprising:

• a processor;
• an external database external to a vulnerability data management device managed and operated by an organization;
• a local database embedded within the vulnerability data management device;
• and
• a communication network,
• wherein the processor is configured to:
• establish a link between the external database and the local database via the communication network;
• receive continuous feed of vulnerability data from the external database and store the feed of vulnerability data onto the local database, the vulnerability data including a list of vulnerabilities and corresponding risks;
• filter the received vulnerability data to exclude vulnerabilities that are not applicable to systems managed and operated by the organization and store the filtered vulnerability data onto the local database;
• cause a graphical user interface (GUI) to display the filtered vulnerability data to a user;
• compare a risk score associated with each vulnerability included in the filtered vulnerability data to a predefined threshold value;
• determine, based on comparing, whether the risk score exceeds the predefined threshold value;
• modify, based on determining that the risk score exceeds the predefined threshold value, the risk score by receiving user input via the GUI in accordance with risk information applicable to the systems managed and operated by the organization;
• and
• update the list of vulnerabilities of the filtered vulnerability data stored in the local database by supplementing with the modified risk score without overwriting the risk score associated with each vulnerability initially received from the external database.

A non-transitory computer readable medium configured to store instructions for managing vulnerability data, wherein when executed, the instructions cause a processor to perform the following:

• establishing a link between an external database external to a vulnerability data management device managed and operated by an organization and a local database embedded within the vulnerability data management device via a communication network;
• receiving continuous feed of vulnerability data from the external database and storing the feed of vulnerability data onto the local database, the vulnerability data including a list of vulnerabilities and corresponding risks;
• filtering the received vulnerability data to exclude vulnerabilities that are not applicable to systems managed and operated by the organization and storing the filtered vulnerability data onto the local database;
• causing a graphical user interface (GUI) to display the filtered vulnerability data to a user;
• comparing a risk score associated with each vulnerability included in the filtered vulnerability data to a predefined threshold value;
• determining, based on comparing, whether the risk score exceeds the predefined threshold value;
• modifying, based on determining that the risk score exceeds the predefined threshold value, the risk score by receiving user input via the GUI in accordance with risk information applicable to the systems managed and operated by the organization;
• and
• updating the list of vulnerabilities of the filtered vulnerability data stored in the local database by supplementing with the modified risk score without overwriting the risk score associated with each vulnerability initially received from the external database.