Summary: Weekly Security summaries are an indespensible part of staying on top of issues that affect your machines and networks.

Recently, I presented my recommendations for security alert mailing lists (Where to Go for Timely Alerts.) If you want timely, in-your-face notification of issues that you need to address pronto, then subscribe to those kinds of lists.

The other side of the coin includes lists recapping many security- related issues. Such summaries may extend beyond just Linux issues, which is good if you are administrating a heterogeneous environment or if you simply want to smile at how many vulnerabilities have been found in non-Unix operating systems.

• Linuxsecurity.com
  Linuxsecurity.com (http://www.linuxsecurity.com/general/newsletter.html) -- by the folks at Guardian Digital who created the EnGarde Linux distro -- has both an excellent Web page and weekly summaries. Yes, I know I said I never read Web pages for security info, but I lied. This one has pointers to all the interesting articles you might want to read while you're waiting for that compile to finish.

  The site's "Security Advisories Weekly" details all the advisories released during the previous week, while the "Linux Security Newsletter" discusses those advisories and broader security issues as well. Folks sometimes ask why Hackinglinuxexposed.com doesn't produce a weekly security newsletter. The answer? Linuxsecurity.com already fills that niche perfectly.

• SANS
  SANS (http://www.sans.org/sansnews) puts out a "Security Alert Consensus" every week, covering all the vulnerabilities found that week and grouped by OS. It also has the "SANS NewsBites" list, which gives you quick snippets of security-related articles you may have missed. Five to ten security professionals edit the NewsBites mailings. Sometimes the best part of the mail is reading what the editors think of the articles.

• SecurityFocus Newsletter
  This list provides quick links to SecurityFocus (http://www.securityfocus.com) articles, the week's top security tools, and summaries of SecurityFocus's BugTraq, Incidents, Vuln-Dev, and other lists. This is an excellent list if you don't have enough personal bandwidth to read all those mailing lists in real-time.

• InfoSec News
  ISN (http://www.c4i.org/isn.html) shoots copies of interesting security- related articles directly to your email. The articles are very wide ranging; they're usually not related to specific vulnerabilities, but they do offer some enjoyable security reading. Volume ranges from one to ten messages a day. Yeah, it's not a weekly security reminder, but it's fun.

• CERT Summary
  Each quarter CERT (http://www.cert.org) publishes a list of the top vulnerabilities out there on the big scary Internet. By the time this comes out, you should have long since patched your machines. Subscribe your manager to this list.

Bri Hatch is Chief Hacker at Onsight, Inc and author of Hacking Linux Exposed and Building Linux VPNs. He subscribes to so many lists that his .procmailrc is bigger than most of the emails he gets. And he still gets a lot of twenty-page 'Good Times' viruses... Bri can be reached at bri@hackinglinuxexposed.com.

Copyright Bri Hatch, 2002.

This article was first published here in ITworld.com Inc., 118 Turnpike Rd., Southborough, MA 01772  on 26-Mar-2002.