Many experts believe that vulnerability management covers several stages. First, all possible software assets in the company’s IT infrastructure should be identified. Once you have this list, you can find actual vulnerabilities that are already known and fix them. You should also check whether the discovered vulnerabilities are really fixed.
The process of working with vulnerabilities is not just sorting through the list of potential threats. This is a complex process that must be well managed.
Vulnerability management is part of the existing risk management system. As already mentioned, after the asset inventory, we find vulnerabilities and prioritize them. At this stage, signs are already appearing that require special management. It is necessary to immediately specify how the identified risks will be handled.
Remediation of vulnerabilities is a well-defined, not a stochastic process. The tactic of its implementation is determined mainly by what tools are used to solve the tasks.
The choice of tactics is essential. If security issues are resolved spontaneously, then the task of eliminating vulnerabilities may lose its boundaries. The company begins to experience a shortage of time, resources, and employees. This should be taken into account in advance.
The main problem here is the use of solutions that claim full coverage of the process of eliminating vulnerabilities. None of them actually solve this problem.
In reality, it resembles pseudo-management. Such solutions already use built-in analysis and processing features. This limits the capabilities of the analyst in the company. All-in-one tools make analysts’ decisions less flexible.
This also applies to solutions characterized by a huge number of settings. Redundancy complicates the process of prioritizing vulnerabilities. Moreover, such systems often do not allow you to select an asset or vulnerability that the company wants to recognize as critical.
Methods for detecting vulnerabilities can be divided into two classes: "black box" and "white box." The former is a kind of penetration test that simulates the actions of an attacker. The latter is more reminiscent of the work of an antivirus, revealing characteristic activity using the existing signature.
Source: https://betanews.com/2022/10/03/vulnerability-management-2023/
