97 Things Every Information Security Professional Should Know

Chapter 53. Best Practices with Vulnerability Management

Mari Galloway

Vulnerability management (VM) is on everyone’s mind, but most don’t know how to successfully implement and maintain a fully functional program. It’s more than just having tools in place and running scans. Vulnerability management is the cyclical process of identifying, categorizing, prioritizing, remediating, and mitigating software vulnerabilities.

For new organizations and old ones referencing the CIS Top 20 Basic Security Controls, you see that VM is the third control on that list after identifying all your assets and software. This means, before any penetration testing or implementation of other controls, you MUST identify your systems and the vulnerabilities first. This will drive the rest of your controls as you are able to see what is critical and what should be remediated or mitigated to improve your security posture.

Here are four best practices for successfully implementing and maintaining a vulnerability management program:

Have a dedicated team.

This may seem like a no-brainer, having two or three people to dedicate time and energy to this entire process. But some organizations may leave the VM process to the security operations team, who are already swamped with alerts. Having a dedicated team not only allows the organization to tackle this process effectively, but also gives the cyber team the ...