Vulnerability management

This article needs additional citations for verification. Please help improve this article by adding citations to reliable sources. Unsourced material may be challenged and removed.
Find sources: "Vulnerability management" – news · newspapers · books · scholar · JSTOR (June 2013) (Learn how and when to remove this message)

|

Vulnerability management is the "cyclical practice of identifying, classifying, prioritizing, remediating, and mitigating"  software vulnerabilities.[1] Vulnerability management is integral to computer security and network security, and must not be confused with vulnerability assessment.[2]

Vulnerabilities can be discovered with a vulnerability scanner, which analyzes a computer system in search of known vulnerabilities,[3] such as open ports, insecure software configurations, and susceptibility to malware infections. They may also be identified by consulting public sources, such as NVD, vendor specific security updates or subscribing to a commercial vulnerability alerting service. Unknown vulnerabilities, such as a zero-day,[3] may be found with fuzz testing. Fuzzy testing can identify certain kinds of vulnerabilities, such as a buffer overflow with relevant test cases. Such analysis can be facilitated by test automation. In addition, antivirus software capable of heuristic analysis may discover undocumented malware if it finds software behaving suspiciously (such as attempting to overwrite a system file).

Correcting vulnerabilities may variously involve the installation of a patch, a change in network security policy, reconfiguration of software, or educating users about social engineering.

## Project vulnerability management[edit]

Project vulnerability is the project's susceptibility to being subject to negative events, the analysis of their impact, and the project's capability to cope with negative events.[4] Based on Systems Thinking, project systemic vulnerability management takes a holistic vision, and proposes the following process:

1. Project vulnerability identification
2. Vulnerability analysis
3. Vulnerability response planning
4. Vulnerability controlling – which includes implementation, monitoring, control, and lessons learned

Coping with negative events is done, in this model, through:

* resistance – the static aspect, referring to the capacity to withstand instantaneous damage, and
* resilience – the dynamic aspect, referring to the capacity to recover in time.

Redundancy is a specific method to increase resistance and resilience in vulnerability management.[5]

Antifragility is a concept introduced by Nassim Nicholas Taleb to describe the capacity of systems to not only resist or recover from adverse events, but also to improve because of them. Antifragility is similar to the concept of positive complexity proposed by Stefan Morcov.

## See also[edit]

* Application security
* Full disclosure
* IT risk
* Long-term support
* Project management
* Project complexity
* Risk management

## References[edit]

1. ^ Foreman, Park (2010). Vulnerability management. Boca Raton: CRC Press. p. 1\. ISBN 978-1-4398-0151-2. OCLC 444700438.
2. ^ Walkowski, Michał; Oko, Jacek; Sujecki, Sławomir (19 September 2021). "Vulnerability Management Models Using a Common Vulnerability Scoring System". Applied Sciences. 11 (18): 8735. doi:10.3390/app11188735.
3. ^ a b Anna-Maija Juuso and Ari Takanen Unknown Vulnerability Management, Codenomicon whitepaper, October 2010 [1].
4. ^ Marle, Franck; Vidal, Ludovic-Alexandre (2016). Managing Complex, High Risk Projects. London: Springer London. p. [page needed]. doi:10.1007/978-1-4471-6787-7. ISBN 978-1-4471-6785-3. OCLC 934201504.[Wikipedia:Citing+sources|page-needed]&rft.pub=Springer+London&rft.date=2016&rft_id=info:oclcnum/934201504&rft_id=info:doi/10.1007/978-1-4471-6787-7&rft.isbn=978-1-4471-6785-3&rft.aulast=Marle&rft.aufirst=Franck&rft.au=Vidal,+Ludovic-Alexandre&rfr_id=info:sid/en.wikipedia.org:Vulnerability+management" class="Z3988">
5. ^ Nassim N. Taleb, Daniel G. Goldstein (2009-10-01). "The Six Mistakes Executives Make in Risk Management". Harvard Business Review. ISSN 0017-8012. Retrieved 2021-12-13.

## External links[edit]

* "Implementing a Vulnerability Management Process". SANS Institute.

* v
* t
* e

Information security

Related security categories|

* Computer security
* Automotive security
* Cybercrime
* Cybersex trafficking
* Computer fraud
* Cybergeddon
* Cyberterrorism
* Cyberwarfare
* Electromagnetic warfare
* Information warfare
* Internet security
* Mobile security
* Network security
* Copy protection
* Digital rights management

vectorial version

Threats|

* Adware
* Advanced persistent threat
* Arbitrary code execution
* Backdoors
* Hardware backdoors
* Code injection
* Crimeware
* Cross-site scripting
* Cross-site leaks
* DOM clobbering
* History sniffing
* Cryptojacking
* Botnets
* Data breach
* Drive-by download
* Browser Helper Objects
* Viruses
* Data scraping
* Denial-of-service attack
* Eavesdropping
* Email fraud
* Email spoofing
* Exploits
* Hacktivism
* Insecure direct object reference
* Keystroke loggers
* Logic bombs
* Time bombs
* Fork bombs
* Zip bombs
* Fraudulent dialers
* Malware
* Payload
* Phishing
* Voice
* Polymorphic engine
* Privilege escalation
* Ransomware
* Rootkits
* Scareware
* Shellcode
* Spamming
* Social engineering
* Spyware
* Software bugs
* Trojan horses
* Hardware Trojans
* Remote access trojans
* Vulnerability
* Web shells
* Wiper
* Worms
* SQL injection
* Rogue security software
* Zombie

Defenses|

* Application security
* Secure coding
* Secure by default
* Secure by design
* Misuse case
* Computer access control
* Authentication
* Multi-factor authentication
* Authorization
* Computer security software
* Antivirus software
* Security-focused operating system
* Data-centric security
* Obfuscation (software)
* Data masking
* Encryption
* Firewall
* Intrusion detection system
* Host-based intrusion detection system (HIDS)
* Anomaly detection
* Security information and event management (SIEM)
* Mobile secure gateway
* Runtime application self-protection
* Site isolation

*[v]: View this template
*[t]: Discuss this template
*[e]: Edit this template