Glossary term
Vulnerability Management
Subject: Technology, Cyber and Data, Cyber Risk and Incident Response
Also known as: Software vulnerability management, Vulnerability and patch management
Vulnerability management is the governed, repeating process of finding weaknesses in systems and software, ranking them by risk, fixing or otherwise controlling them, and checking that the fix worked.
Explanation
The cycle runs from knowing what assets exist, to scanning them, to ranking the findings, to remediation and then verification. Ranking is the hard part. Scanners can report thousands of flaws, so teams weigh severity, whether attackers are already exploiting the flaw, how exposed the system is and how valuable its data is. Patch management, the rollout of vendor fixes, is the commonest remedy. Where a patch cannot be applied, perhaps because an old system would break, the team records an exception and adds a compensating control, such as isolating the system. Timelines are set by policy, with faster deadlines for serious flaws. Auditors and regulators ask for evidence of this cycle. Attackers often get in through flaws that had a fix available for months.
Example
A hospital group's weekly scan flags 4,000 findings. The security team ranks them and sees 12 affect internet-facing servers and are being actively exploited. Those are patched within three days. A medical imaging device that cannot be updated is moved to an isolated network segment, with the exception recorded and reviewed each quarter.
Not to be confused with
- Penetration Testing
- A point-in-time attempt to break in. Vulnerability management is the continuing cycle of finding and fixing weaknesses.