Fundamentals Vulnerability Management

Every computer system contains weaknesses, and new ones appear every week. Vulnerability management is the steady practice of finding those weaknesses, ranking them, and fixing the dangerous ones first. The process keeps attackers one step behind.

The Home Inspection Example

A homeowner hires an inspector once a year. The inspector checks the roof, the wiring, and the locks, then writes a list of problems. A leaking roof gets urgent repair, while a squeaky door can wait. Vulnerability management applies the same routine to networks, servers, and applications.

The Management Cycle

The process never ends. New software, new devices, and newly discovered flaws start the loop again.

  +----------+     +----------+     +------------+
  | Discover | --> |  Assess  | --> | Prioritize |
  +----------+     +----------+     +------------+
       ^                                   |
       |                                   v
  +----------+     +----------+     +------------+
  |  Report  | <-- |  Verify  | <-- | Remediate  |
  +----------+     +----------+     +------------+

Each Stage Explained

Discover

Teams build an inventory of every device, application, and cloud service. A system that nobody knows about cannot receive a fix.

Assess

Scanning tools compare the inventory against databases of known flaws. The tools produce a list of findings.

Prioritize

Analysts rank findings by severity and by business impact. A serious flaw on a public website outranks a minor flaw on an isolated test machine.

Remediate

Teams fix the problem through a patch, a configuration change, or a protective workaround.

Verify

A second scan confirms that the fix worked and caused no new trouble.

Report

Managers receive summaries that show progress, trends, and remaining risks.

Understanding Severity Scores

Most reports use the Common Vulnerability Scoring System, or CVSS. Each flaw receives a score from 0 to 10. Public flaws carry a CVE number, a unique label that lets everyone refer to the same problem.

Smart teams look beyond the score. They ask whether attackers already use the flaw, whether the system faces the internet, and how valuable its data is.

Types of Scans

• Network scans check servers and devices for open services and known flaws.
• Web application scans test sites for problems like injection and weak settings.
• Authenticated scans log in to a system for a deeper look at installed software.
• Container and code scans examine software before release.

Patch Management

Patching forms the most common fix. Good patch management follows a routine. Teams test updates on a small group of machines before rolling them out widely. Critical emergency patches skip the long schedule. Systems that cannot take updates, such as old medical devices, receive extra protection like network isolation.

Example: A Hospital Network

A hospital scans its network on the first day of each month. The scan finds 400 issues. Analysts sort them and flag 12 critical flaws on systems that touch patient records. The team patches those 12 within a week. Lower-ranked issues join the regular maintenance schedule. A follow-up scan confirms the results, and the board reads a one-page summary.

Challenges

• Thousands of findings overwhelm small teams
• Patches sometimes break applications
• Unknown devices hide outside the inventory
• Business owners resist downtime for updates

Key Points

• Vulnerability management repeats a cycle of discover, assess, prioritize, remediate, verify, and report.
• CVSS scores guide urgency, and business context sharpens the ranking.
• Complete asset inventories make every other step possible.
• Regular scanning and timely patching shrink the attack surface.