What is Vulnerability Management?

Vulnerability management is often thought in terms of a tool, and there’s no shortage of vulnerability management tools out there to help you stay on top of risks. But at its core, vulnerability management is a process.

Today’s businesses have the challenge of finding security vulnerabilities, which are assets that can be exploited by bad actors, and remediating them before a cyber threat can exploit them. But as the pace of cyber attacks increases, companies that are serious about securing their assets must turn to vulnerability management (VM). Through VM, businesses can mitigate their risk of attack multiple times over before a threat even materializes.

While managing vulnerabilities includes processes such as vulnerability assessment, scanning and monitoring, these components only make up a portion of the management process. Vulnerability management is a holistic process allowing companies to continuously monitor, patch, and report security vulnerabilities to defend their networks and information from future cyber threats. This is done through the scanning, prioritizing, assessing, remediating, verifying and reporting of vulnerabilities. The more seamless the process, the more efficient.

Threat preemption is exactly why security-focused organizations are particularly keen on vulnerability management. Rather than responding to incidents as they arise, vulnerability management fosters a framework for nipping threats in the bud.

The market trend paints the picture, as the market for security and vulnerability management is forecast to grow at a double-digit clip annually through 2024. As data breaches become more commonplace, it’s likely that growth accelerates further. By investing in vulnerability management, businesses can protect their assets for years to come.

Comprehensive vulnerability management solutions contain an assessment to detect cyber risks. Some common examples include:

• SQL Injection
• Broken Authentication
• Cross-site Scripting
• Security Misconfiguration
• Escalation of Privileges
• Insecure Defaults

Vulnerability Scanning: Vulnerability scanning is important in detecting exploitable assets, and it’s often confused for vulnerability management. And while vulnerability scanning is a crucial part of the process, it’s just that: a single aspect of VM. Scanning helps in the identification of vulnerabilities in a company’s infrastructure or networks, while VM includes multiple steps that include risk acceptance and remediation.

Vulnerability Assessment: When a threat is detected, it occurs during the assessment stage in VM. Like vulnerability scanning, vulnerability assessment (VA) is often confused with vulnerability management. On the one hand, vulnerability assessment is defined by its having a start and an end date. Vulnerability management, on the other hand, is an ongoing process which typically includes an assessment stage. There are many different types of assessments to employ, including:

• Host Assessment
• Database Assessment
• Network assessment
• Application scanning

At the highest level, vulnerability management is made up of five distinct stages which are most effective when used continuously and holistically. At Nucleus, we subscribe to the SANS Vulnerability Management Maturity Model, which is outlined as:

1. Prepare: This focus area is dedicated to what we need to make sure is in place for a successful vulnerability management program. In this section, we have two sub-areas: Policy & Standards, and Context.
2. Identify: This focus area comes down to how do we find the vulnerabilities within our organizations. We have three sub-groupings in this section: Automated, Manual, and External.
3. Analyze: This section is all about the data: how to look at, categorize, and prioritize the identified vulnerabilities. This section has two sub-areas: Prioritization and Root Cause Analysis (can you tell we have done project management before?).
4. Communicate: Once we have the information in hand, this focus area comes into play. We take all the data we have and pass it along to others that need it, in a useable format. There are two sub-groups here: Metrics & Reporting, and Alerting.
5. Treat: Finally, the part where all the work gets done to fix the problems we have. The three sub-areas are Change Management, Patch Management, and Configuration Management.

As mentioned earlier, these steps do not end but continue on a regular basis in order to keep up with an evolving risk profile.