What is Vulnerability Management
Process of identifying and fixing vulnerabilities
Vulnerability Management is a continuous process of identifying, assessing, prioritizing, and remediating vulnerabilities in information systems.
Process Stages
- Discovery — system scanning
- Assessment — criticality determination
- Prioritization — risk-based ranking
- Remediation — patching or mitigation
- Verification — fix validation
Tools
- Nessus, Qualys, OpenVAS
- Rapid7 InsightVM
- Tenable.io
- Microsoft Defender
Metrics
- MTTR — mean time to remediate
- Vulnerability Age — age of vulnerability
- Patch Coverage — percentage of patched systems
- Risk Score — overall risk level
Standards
- CVE — vulnerability identification
- CVSS — criticality scoring
- NVD — vulnerability database