Threat/Vulnerability Catalogue for risk assessment

[Brunforg]

Hello

We are looking to do Risk assessment in our company ( asset based ) and was wondering if you could share any Vulnerability/threat catalogue that would show the types of threats/vulnerabilities to consider

Do you guys use such catalogue to make risk assessment easier when conducting consultancy ? Or what do you use to make risk assessment easier ?

Please help

 

[Tagin]

Just googling around, I saw this:
Free List of Information security threats and vulnerabilities

 

[yodon]

And there's the NIST National Vulnerabilities Database (NVD)

 

[Ragnarok]

Hello

I actually meant something like the ISO 27005 threat/Vulnerability catalogue, where threat and vulnerabilities were tied one to another and also tied to a specific asset type, like HW, SW, persons, network... Etc... Can anyone help with any such guides? Would help us a lot

Thanks

 

[akp060]

Hi Brunforg,

Regarding the type of vulnerabilities to be considered, a Cybersecurity Bill of Materials would help. It is essentially the list of all SOFTWARE ITEMS that are likely to get impacted. The types of threat would then be easy to identify that can impact each of these "list items". I am sure there would not be a catalog. Guess you will have to make your own.

There is one more thread that I observed and may help you
Medical device vulnerability highlights problem of third-party code in IoT devices