97 Things Every Information Security Professional Should Know

Chapter 82. Vulnerability Management

Siggi Bjarnason

At a super high level, the concept of vulnerability management is pretty simple. It’s all about managing your vulnerabilities. When you dive deeper, then questions start to surface. Questions such as:

• What exactly is a vulnerability?

• How do I know know what my vulnerabilities are?

• Can I manage something I don’t know about?

Some think that vulnerability management is all about having vulnerability scanners such as Tenable Nessus or Qualys and periodically running scans with them. Others believe it involves periodic penetration testing. Not only is this extremely flawed thinking, but it is also potentially dangerous and increases your exposure instead of reducing it.

The purpose of a good vulnerability management program is to reduce your exposure and make it easier for you to respond when an issue comes up. To answer the preceding questions, you can’t manage something you don’t know about. To define the word “vulnerability,” turn to any English dictionary; it will give a good definition applicable here. The third question will require some discussion.

Since you can’t manage what you don’t know about, a good asset and configuration management is the foundation of a good vulnerability management program. If you can only do one thing, just get your hands around what you have. This, of course, starts with knowing what computers ...