Vulnerability Management.

What is vulnerability management?

A vulnerability is a weakness in software or a device that an attacker could use. Vulnerability management is the ongoing work of finding these weaknesses and dealing with them.

NIST describes it as an information security continuous monitoring capability. In NIST’s words, it identifies vulnerabilities on devices that are likely to be used by attackers to compromise a device and use it as a platform from which to extend compromise to the network.

OWASP says vulnerability management is one of the most effective means of controlling cybersecurity risk. It says vulnerability management seeks to help organizations identify such weaknesses in their security posture so that they can be rectified before they are exploited by attackers.

How does a vulnerability management process work?

The OWASP guide covers the full vulnerability management lifecycle. It names four phases.

• Preparation, which sets things up before any checking begins.
• Vulnerability identification and scanning, which finds the weaknesses.
• Reporting, which records what was found.
• Remediation, which means fixing the weaknesses.

What is a simple example?

This is a simple illustration. A team finds a known weakness in software on one of its devices. The team records it, decides how urgent it is, and then fixes it. A vulnerability management program is this cycle repeated as a standing routine, not a one-off task.

How do organizations decide what to fix first?

CISA keeps the Known Exploited Vulnerabilities (KEV) catalog. CISA calls it the authoritative source of vulnerabilities that have been exploited in the wild. CISA says organizations should use the catalog as an input to their vulnerability management prioritization framework.

CISA Binding Operational Directive 22-01 gave one reason. It said vulnerabilities that have previously been used to exploit public and private organizations are a frequent attack vector. The directive applied to United States federal agencies and told them to review and update their internal vulnerability management procedures. It set default fix deadlines for catalog entries: two weeks for all others, and six months for vulnerabilities whose CVE identifier was assigned before 2021. A CVE (Common Vulnerabilities and Exposures) identifier is a public ID for a known vulnerability.

CISA’s page now says BOD 22-01 has been revoked and superseded by BOD 26-04, Prioritizing Security Updates Based on Risk. Check that directive for current federal requirements.

How does it relate to nearby terms?

Patch management is the work of applying software updates that fix flaws. It is often one way to carry out the remediation phase. CVSS, the Common Vulnerability Scoring System, rates how severe a vulnerability is. A severity score can often help a team rank what to look at first.

Is vulnerability management the same as patch management?

No. Patch management is about applying updates. Vulnerability management is wider. It includes preparation, identification, reporting and remediation, as the OWASP guide describes.

Is vulnerability management the same as vulnerability scanning?

No. Scanning is one part of the identification phase in the OWASP guide. A scan on its own finds weaknesses but does not report on them or fix them. The full process also covers preparation, reporting and remediation.

See also

• Vulnerability intelligence