Vulnerability Management

All systems contain vulnerabilities. They can be configuration issues for system administrators to resolve, software defects that need a vendor update, or vulnerabilities the vendor does not yet know exist. A vulnerability management process shows which vulnerabilities are present in an organization's estate and where updates are failing, and it helps the organization react quickly when a critical vulnerability is disclosed by showing its exposure.

The process starts with keeping systems updated, ideally automatically. Automated vulnerability scanning, guided by the asset inventory, finds what updates do not fix. The NCSC advises assessments across the entire estate at least every month. The organization then triages findings by severity, risk of exploitation, and impact on the organization. A severity rating such as CVSS is an input, but the decision weighs business impact and risk. Fixes go first to internet-facing services and to vulnerabilities that would do the most damage if exploited.

Vulnerabilities that are hard to fix get alternative mitigations, and unmitigated vulnerabilities and their risks are recorded in a risk register. Where high-risk legacy systems cannot be upgraded, they should be segregated from the rest of the network. NIST describes vulnerability management as a continuous monitoring capability that identifies vulnerabilities on devices that attackers are likely to use to compromise a device and extend the compromise to the network.