Security Operations · Topic 5 of 13
Vulnerability Management
Security+ vulnerability management: scans, threat feeds, bug bounties, CVE and CVSS scoring, prioritization, remediation options and validation.
- 4 min
- The cycle is identify, analyze, prioritize, remediate, validate and report.
- A false positive is a reported flaw that is not real. A false negative is a real flaw that was missed.
- CVE identifies a flaw, and CVSS scores its severity from 0 to 10.
What it is
Vulnerability management is the continuing process of finding weaknesses, deciding which matter most, fixing or reducing them and confirming the result.
It is a cycle, not a one time scan. New flaws are announced every day, and systems change constantly.
How it works
Identification methods
| Method | What it provides |
|---|---|
| Vulnerability scan | Automated check of systems for known flaws and misconfigurations |
| Application security testing | Static analysis, dynamic analysis and package monitoring of code and components |
| Threat feeds | Information from open source intelligence (OSINT), commercial providers, information sharing groups and the dark web |
| Penetration testing | Authorized attempts to exploit weaknesses to show real impact |
| Responsible disclosure and bug bounty programs | Outside researchers report flaws, sometimes for a reward |
| System and process audits | Reviews of configuration and procedure |
A scan can be credentialed, where the scanner logs in and sees more detail, or non credentialed, where it sees only what an outsider sees. Credentialed scans find more and produce fewer false results.
Analysis
A scanner result is not automatically true or important.
| Concept | Meaning |
|---|---|
| False positive | The tool reports a flaw that does not exist |
| False negative | A real flaw is missed |
| Common Vulnerabilities and Exposures (CVE) | A public list that gives each known flaw a standard identifier |
| Common Vulnerability Scoring System (CVSS) | A 0 to 10 score of technical severity |
| Exposure factor | The share of an asset's value likely to be lost if the flaw is exploited |
| Environmental variables | Local conditions that change the real risk |
The CVSS bands are Low (0.1 to 3.9), Medium (4.0 to 6.9), High (7.0 to 8.9) and Critical (9.0 to 10.0). A score of 0 means none.
Classify each finding before prioritizing it, because the class suggests the fix and the owner.
| Classify by | Examples |
|---|---|
| Type | Software flaw, hardware flaw, misconfiguration, weak cryptography |
| Severity band | Low, Medium, High or Critical from the CVSS score |
| Weakness category | The Common Weakness Enumeration (CWE) entry that names the kind of coding or design error, while the CVE names the specific flaw |
A software flaw is usually patched, a misconfiguration is corrected, and a hardware flaw may need a firmware update, replacement or compensating controls.
Prioritization
Prioritize using the score together with context. A high score on a system that is not reachable may matter less than a medium score on an internet facing server that holds sensitive data. Consider how exploitable the flaw is, how important the asset is, the impact on the business and the organization's risk tolerance.
Response and remediation
| Option | Use |
|---|---|
| Patching | Apply the vendor fix |
| Segmentation | Limit access to the vulnerable system |
| Compensating controls | Add other protections when the flaw cannot be fixed |
| Insurance | Transfer part of the financial risk |
| Exceptions and exemptions | Formally accept a risk for a defined reason and period |
An exception should be documented, approved and time limited, with compensating controls where possible.
Validation and reporting
After remediation, validate that the fix worked. This uses a rescan, an audit or direct verification of the system. Reports then show the results to the right audience, such as technical staff who need lists and managers who need trends and risk.
What to remember for the exam
- The cycle is identify, analyze, prioritize, remediate, validate and report.
- A false positive is a reported flaw that is not real. A false negative is a real flaw that was missed.
- CVE identifies a flaw, and CVSS scores its severity from 0 to 10.
- Credentialed scans see more than non credentialed scans.
- Prioritize by severity, exploitability, asset importance and business impact.
- Remediation options include patching, segmentation, compensating controls, insurance and exceptions.
- Validate with a rescan, an audit or verification.
- A bug bounty pays outside researchers who report flaws responsibly.
When a scenario says a patch cannot be applied, look for segmentation or a compensating control, plus a documented exception.
Common mistakes
Fixing only the highest score. A moderate flaw on a critical, exposed system may deserve first attention.
Trusting every scanner result. Always confirm results, since false positives waste time and false negatives leave gaps.
Mixing up CVE and CVSS. CVE names a flaw, and CVSS rates how severe it is.
Skipping validation. A patch that failed to install looks the same as one that worked until you check.
Treating a penetration test as a scan. A scan lists possible flaws, while a penetration test tries to exploit them to show impact.
An exception that never expires becomes a permanent hole. Set a review date and recheck the risk.
Check yourself
What does a CVSS score measure?
The technical severity of a vulnerability on a scale from 0 to 10.
Why are credentialed scans preferred?
The scanner logs in and sees installed software and settings, so it finds more flaws with fewer false results.
What is a false negative?
A real vulnerability that the scan failed to report.
Topic 5 of 13 in Security Operations
Test yourself on Security Operations
The full CompTIA Security+ SY0-701 question bank has 848 questions, with timed practice exams and an explanation for every answer.
This study guide is independent and is not affiliated with, endorsed by, or sponsored by CompTIA. Vendor names, certification names and exam codes are trademarks of their respective owners and are used for identification only.