New security vulnerabilities in operating systems, applications, network devices, and cloud services become known all the time. Many attacks do not use the newest vulnerabilities but ones that have been known for a long time and for which updates have long been available. Vulnerability management ensures that a company knows where it is vulnerable and closes these gaps in an orderly manner.
How does vulnerability management work?
The process runs as a cycle:
- Inventory: All systems, applications, and services are recorded. What is not known cannot be protected.
- Detection: Vulnerability scanners and agents regularly check systems for known vulnerabilities and misconfigurations.
- Assessment: Each finding is classified by risk. Helpful here are the public CVE identifier, the CVSS severity rating on a scale from 0 to 10, and indications of whether a vulnerability is already being actively exploited.
- Remediation: Updates are installed, configurations adjusted, or, if no update is available yet, workarounds implemented.
- Verification: A repeat scan confirms that the vulnerability has been closed.
Prioritization is decisive. A medium-severity vulnerability on a server reachable from the internet can be more urgent than a critical vulnerability on an isolated test system.
Besides software flaws, misconfigurations are also part of vulnerability management, for example openly reachable management interfaces or default passwords. An outside view also helps: which of a company's systems are visible from the internet at all? In addition, penetration tests at longer intervals check manually whether vulnerabilities can actually be exploited.
Typical examples
- A scan shows that a firewall uses firmware with a known vulnerability in the VPN service.
- An outdated version of PDF software is running on several workstations.
- A server is reachable from the internet with an insecure encryption configuration.
- For a newly disclosed zero-day vulnerability, it must be determined quickly which systems are affected.
What companies should keep in mind
- Maintain a complete inventory, see IT asset management.
- Set remediation deadlines by risk level and name the people responsible.
- Closely integrate vulnerability management with patch management.
- Document exceptions and set time limits when a system temporarily cannot be updated.
- Report results to management regularly, also as evidence, for example in the context of NIS2.
How TOMORIS relates
In TOMORIS's connected IT operations, the building block GRID.scout makes vulnerabilities visible.
View GRID.scout