Zero Trust Security

Chapter 10 Vulnerability Management

In today’s information technology (IT) landscape, an organisation’s network comprises a multitude of systems and devices. Vulnerabilities can affect each of these systems, which attackers can exploit to gain access to the network. For this reason, having a vulnerability management process is crucial for safeguarding an organisation’s systems against vulnerabilities. A Zero Trust approach emphasises vulnerability management, which entails confirming that the systems and software functioning within the environment maintain a secure state. I want you to think of vulnerability management as a process for identifying and prioritising which systems need patching or reconfiguration to move them from an insecure to a secure state.

You might wonder why vulnerability management is necessary when a patch management system is already in place. The inability to automatically update some systems necessitates manual updates, delaying the process and increasing the potential for oversights. Not all vulnerabilities are just about patching; vulnerabilities often also arise from misconfiguration of the system. Vulnerability management is the process by which we identify these discrepancies or oversights in our environment. The process does this by identifying, evaluating, treating and reporting on vulnerabilities found within the environment. Giving a little more detail about the step, the process should look something like this:

1. Determine if any vulnerabilities ...