Vulnerability management
Exam objective 4.3: Explain various activities associated with vulnerability management.
On this page
Vulnerability management is a loop: identify weaknesses, analyze and prioritize them, respond, validate the fix, and report. The exam covers identification methods, CVSS and CVE, false positives and negatives, exposure factor, and remediation choices.
Identification
| Method | What it finds |
|---|---|
| Vulnerability scan | Known flaws and misconfigurations on hosts and apps |
| Application security testing | Static, dynamic, and package analysis of code |
| Threat feeds / OSINT | Newly disclosed flaws and active exploitation |
| Penetration testing | Whether flaws can actually be exploited |
| Bug bounty / responsible disclosure | Flaws reported by outside researchers |
| System and process audit | Weaknesses in configuration and procedures |
Credentialed scans log in to the target and see much more than non-credentialed scans, which see what an outside attacker sees. Package monitoring watches third-party libraries for new advisories.
Analysis and response
Each finding is confirmed and prioritized. A false positive is a reported flaw that isn't really there; a false negative is a real flaw the scan missed, which is more dangerous because nobody looks for it. The Common Vulnerabilities and Exposures (CVE) list gives each flaw an ID; the Common Vulnerability Scoring System (CVSS) rates severity from 0 to 10. Priority also weighs exposure (is it reachable?), environmental variables, industry impact, and risk tolerance.
Responses: patch, buy insurance, segment, use compensating controls, or grant an exception with documented risk acceptance. Then validate with a rescan, audit, or verification, and report.
Key terms
- Vulnerability scan
- An automated check of systems for known flaws, missing patches, and misconfigurations.
- Credentialed scan
- A vulnerability scan that logs in to targets for a deeper, more accurate view.
- Common Vulnerabilities and Exposures (CVE)
- A public catalog that gives each known vulnerability a unique identifier.
- Common Vulnerability Scoring System (CVSS)
- A standard way to rate a vulnerability's severity on a 0 to 10 scale.
- False positive
- An alert or finding that reports a problem that doesn't actually exist.
- False negative
- A real vulnerability or attack that a tool fails to detect.
- Exposure factor
- The percentage of an asset's value expected to be lost if a specific threat occurs.
- Bug bounty program
- A program that pays outside researchers for responsibly reporting vulnerabilities.
- Penetration testing
- Authorized simulated attacks that try to exploit vulnerabilities to prove real impact.
- Vulnerability exception
- A documented, approved decision not to remediate a vulnerability for now, with accepted risk.
- Rescanning
- Running the scan again after remediation to confirm the vulnerability is fixed.
Check yourself
22 practice questions on this objective
Practice this objectiveFlashcards for this objective