Risk Assessment · Topic 2 of 6
Vulnerability Management
CRISC vulnerability management: finding weaknesses in people, process and technology, scanning and testing, CVSS, risk-based prioritization and patch SLAs.
- 4 min
- Vulnerabilities exist in technology, processes, people, facilities and suppliers.
- CVSS measures technical severity, not organizational risk.
- Prioritize using criticality, exposure, exploitability and existing controls.
What it is
A vulnerability is a weakness that a threat could exploit. It can sit in technology (an unpatched server), in a process (no approval step for payments) or in people (staff who have never been trained to spot phishing).
Vulnerability management is the continuous cycle of finding, prioritizing, fixing and verifying these weaknesses. For the risk practitioner, the key word is prioritizing: there are always more vulnerabilities than resources, so the business impact decides what gets fixed first.
How it works
Sources of vulnerabilities
| Area | Examples |
|---|---|
| Technology | Missing patches, default passwords, misconfigured cloud storage, end of support software |
| Process | No segregation of duties, weak change control, no offboarding step |
| People | Lack of awareness, single key person, social engineering susceptibility |
| Physical | Unlocked server rooms, no visitor logs |
| Third party | Supplier with weak controls and access to the network |
Ways to find them
| Technique | What it does | Limitation |
|---|---|---|
| Automated vulnerability scanning | Checks systems against known vulnerabilities and configurations | False positives; finds only known issues |
| Penetration testing | Skilled testers try to exploit weaknesses, as an attacker would | Point in time; limited scope and duration |
| Configuration reviews | Compare settings against hardening baselines | Needs a good baseline |
| Code review and application testing | Static and dynamic testing of software | Needs skilled reviewers and tools |
| Control assessments and audits | Find process and people weaknesses | Depends on sampling |
| Social engineering tests | Phishing simulations, pretext calls | Must be authorized and handled ethically |
Penetration tests and social engineering tests need written authorization and agreed scope before they start.
Scoring and prioritization
The Common Vulnerability Scoring System (CVSS), maintained by FIRST, rates technical severity from 0 to 10. CVSS describes how bad a vulnerability is in general, not how much risk it creates for a specific organization.
Risk-based prioritization adds context:
- Asset criticality and data sensitivity from the inventory and classification.
- Exposure, such as whether the system faces the internet.
- Exploitability, such as whether exploit code exists or the flaw is being actively exploited. The US CISA Known Exploited Vulnerabilities catalog is one source.
- Existing controls that reduce the chance of exploitation.
Remediation targets
Organizations set remediation timeframes by severity and criticality, for example critical issues on internet-facing systems within a few days. These are internal standards; the exam expects you to know they should exist and be monitored, not to recall specific numbers.
When a fix is not possible, for instance on a legacy system that cannot be patched, the options are a compensating control (isolation, extra monitoring) or formal risk acceptance by the risk owner, with an expiry date.
Measuring the program
Useful indicators include the share of assets scanned, the number of open critical vulnerabilities, the average time to remediate, and the number past their due date. A growing backlog of overdue critical items is a strong KRI for the risk profile.
A worked example
A scan reports 1,200 vulnerabilities across a company. The security team plans to fix them in CVSS order. The practitioner points out that the highest-scoring item sits on an isolated test server, while a medium-scoring flaw on the internet-facing payment gateway appears in the CISA catalog of actively exploited vulnerabilities.
The team reprioritizes using asset criticality, exposure and exploitation. The payment gateway is patched first. A legacy finance system that cannot be patched is placed on an isolated network segment, and the finance director signs a time-limited acceptance of the remaining risk.
How the exam asks about this
- "What is the BEST basis for prioritizing vulnerability remediation?" The risk each vulnerability poses, combining severity with asset criticality, exposure and exploitability.
- "A critical vulnerability cannot be patched for six months. What should the practitioner recommend?" Compensating controls and documented risk acceptance by the risk owner.
- "What must be in place BEFORE a penetration test starts?" Written authorization and an agreed scope.
What to remember for the exam
- Vulnerabilities exist in technology, processes, people, facilities and suppliers.
- CVSS measures technical severity, not organizational risk.
- Prioritize using criticality, exposure, exploitability and existing controls.
- Unfixable vulnerabilities need compensating controls or formal acceptance with expiry.
- Penetration and social engineering tests require written authorization and scope.
Fixing vulnerabilities in pure CVSS order is a classic wrong answer. ISACA wants remediation driven by risk to the business, which requires knowing the asset and its context.
Common mistakes
Assuming a clean scan means no risk. Scanners miss process and people weaknesses and unknown flaws.
Ignoring verification. A vulnerability is not closed until a rescan or test confirms the fix.
Letting exceptions run forever. Accepted vulnerabilities need an owner, a review date and an expiry.
Check yourself
Why is a CVSS score alone not enough to prioritize remediation?
It measures generic technical severity, not the value of the affected asset, its exposure or whether the flaw is being exploited.
What should happen when a vulnerability cannot be fixed?
Apply compensating controls and have the risk owner formally accept the remaining risk with a review or expiry date.
Name two non-technical sources of vulnerability.
Weak processes such as missing segregation of duties, and people issues such as poor awareness or reliance on one key person.
Topic 2 of 6 in Risk Assessment
Test yourself on Risk Assessment
The full ISACA CRISC question bank has 1,000 questions, with timed practice exams and an explanation for every answer.
This study guide is independent and is not affiliated with, endorsed by, or sponsored by ISACA. Vendor names, certification names and exam codes are trademarks of their respective owners and are used for identification only.