Vulnerability Management
Vulnerability Management
Vulnerability management items are mostly about scoping and interpretation: what the tool actually measured, and what the number actually means.
First, identify. Asset inventory and attack-surface mapping come before scanning - you cannot claim coverage for hosts you never enumerated. Know credentialed (authenticated) versus non-credentialed scanning: credentialed scans read installed packages, registry keys, and patch levels, producing far fewer false positives, but require a properly scoped service account. Agent-based scanning reaches roaming laptops and cloud instances a network scanner never sees. Distinguish vulnerability scanning from penetration testing (a scanner reports; a pentester chains exploits) and from compliance/baseline scanning (checking hosts against a defined configuration standard such as SCAP or STIG content), which is not the same as a full vulnerability assessment.
Second, interpret severity. CVSS is a severity score, not a risk score - it carries no asset value, exposure, or data sensitivity. Base metrics are intrinsic; temporal metrics reflect exploit maturity and remediation level; environmental metrics let you adjust for your own deployment. Scope-changed vectors (S:C) are a common trap because they alter how the base formula is applied. Bands: 0.0 none, 0.1–3.9 low, 4.0–6.9 medium, 7.0–8.9 high, 9.0–10.0 critical. EPSS estimates near-term exploitation probability; use it with CVSS and asset criticality instead of triaging on base score alone.
Third, respond: remediate (patch), mitigate (compensating control), transfer, or formally accept. Validate findings before mass action - scanners produce both false positives (flagging a patched host) and false negatives (missing a vulnerable one).
Worked example. A scanner reports CVSS 9.8 on an internet-facing VPN appliance and 9.8 on an isolated lab printer. Identical base scores, wildly different risk. Rule of thumb: CVSS tells you how bad the flaw is; risk is that severity filtered through exposure, criticality, and exploitation likelihood (EPSS or CISA KEV).