Vulnerability Assessment and Management
Vulnerability Assessment and Management
This domain tests the full loop: discover assets, scan them safely, score and contextualize findings, prioritize against real exploitation, remediate, and verify. Questions frequently hinge on why raw scanner severity is the wrong sole sorting key.
Core rules and concepts
- Terminology: CVE identifies a specific flaw; CWE classifies the weakness type; NVD enriches with CVSS and CPE applicability; a vulnerability is only a risk when a threat can reach the asset.
- Assessment types: unauthenticated scanning sees the network view and produces more false positives; credentialed scanning reads installed packages and registry state and is dramatically more accurate. Configuration/compliance scans check hardening baselines. A penetration test validates exploitability; a red team tests detection and response, not patch lists.
- CVSS v3.1: base metrics are Attack Vector, Attack Complexity, Privileges Required, User Interaction, Scope, Confidentiality, Integrity, Availability; temporal and environmental metrics adjust for exploit maturity and local context. Bands: 0.1–3.9 Low, 4.0–6.9 Medium, 7.0–8.9 High, 9.0–10.0 Critical.
- Context signals: EPSS estimates the probability of exploitation in the next 30 days; the CISA KEV catalog lists flaws with confirmed in-the-wild exploitation; asset exposure and data sensitivity complete the picture.
- Program mechanics: asset inventory and ownership, scan windows and change approval, deduplication, exception and risk-acceptance records with expiry, remediation SLAs tiered by severity and exposure, and post-patch verification scans.
- Threat modeling: STRIDE categorizes threats (Spoofing, Tampering, Repudiation, Information disclosure, Denial of service, Elevation of privilege) during design, before code exists.
Worked example
Two findings compete for the next maintenance window. A: CVSS 9.8, AV:N/AC:L/PR:N/UI:N, on a development server with no route from user VLANs and no public exploit. B: CVSS 6.5, AV:N/AC:L/PR:L/UI:N, on the internet-facing VPN concentrator, with a working public exploit and a CISA KEV listing. Reasoning: B is patched first. Its base score is lower, but internet exposure, low attack complexity for an authenticated path, confirmed exploitation and KEV status dominate. A stays on the register with an owner and a review date, and its segmentation is documented as a compensating control.
Traps that cost marks
- Ranking work by CVSS alone and ignoring KEV, EPSS, exposure or blast radius.
- Treating scanner output as a finding list rather than a hypothesis to validate - false positives erode trust in the program.
- Scanning production at peak hours or without written authorization.
- Confusing a vulnerability assessment (breadth, no exploitation) with a penetration test (depth, exploitation).
- Closing findings without a verification scan.