Vulnerability Management

Vulnerability Management: Continuous process for the detectionDetectionThe capability to identify suspicious activity, attacks, or policy violations in time., prioritization, remediationRemediationThe correction or mitigation of a confirmed security weakness, defect, or misconfiguration., and tracking of vulnerabilitiesVulnerabilityA technical or organizational weakness that can be exploited by a threat.. The topic concerns vulnerabilities and their exploitability. An effective process combines inventorying, detection, risk-based prioritization, remediation, compensating controls, and verificationVerificationConfirmation that a requirement was met or a remediation achieved its intended result..

How it works and where it fits

Vulnerability Management denotes a vulnerability or weakness class whose risk depends on technical cause, reachable attack surface, required conditions, and potential impact. The presence of a flaw is not the same as successful exploitation. Context such as exposed interfaces, available privileges, asset value, and compensating controls determines the actual urgency.

Practical security relevance

Proper treatment covers identification, reproducibility, risk assessment, remediation, and verification. A patch is only one possible measure; secure configuration, input validation, segmentation, or architectural change may be required depending on the cause. After remediation, targeted retesting should confirm that the original attack path is closed and that the change did not introduce harmful side effects.

Related concepts

• VulnerabilityVulnerabilityA technical or organizational weakness that can be exploited by a threat.: A technical or organizational weakness that can be exploited by a threat.
• Vulnerability AssessmentVulnerability AssessmentSystematically identifies and assesses vulnerabilities in a defined environment.: Systematically identifies and assesses vulnerabilities in a defined environment.
• Common Vulnerabilities and ExposuresCommon Vulnerabilities and ExposuresStandardized identification of publicly known IT vulnerabilities.: Standardized identification of publicly known IT vulnerabilities.
• Patch ManagementPatch ManagementPlans, tests, deploys, and monitors security patches and bug fixes.: Plans, tests, deploys, and monitors security patches and bug fixes.