Vulnerability

Vulnerabilities are security flaws that create risk when combined with threats and insufficient controls. Managing vulnerabilities is a continuous process essential to cybersecurity.

Why it matters

• Most breaches exploit known vulnerabilities with available patches.
• The average time to exploit a new vulnerability is shrinking (now under 15 days).
• Organizations typically have thousands of vulnerabilities across their systems.
• Prioritization is essential—you can't fix everything at once.

Vulnerability lifecycle

1. Discovery: Vulnerability is found by researchers, vendors, or attackers.
2. Disclosure: Reported to vendor (responsible disclosure) or publicly.
3. Patch released: Vendor issues a fix.
4. Exploitation: Attackers develop exploits, sometimes before patches.
5. Remediation: Organizations apply patches and mitigations.

Severity scoring

• CVSS (Common Vulnerability Scoring System): 0-10 scale based on exploitability and impact.
• Critical (9.0-10.0): Immediate action required.
• High (7.0-8.9): Prioritize patching.
• Medium (4.0-6.9): Schedule remediation.
• Low (0.1-3.9): Address when convenient.

Types of vulnerabilities

• Software bugs: Buffer overflows, injection flaws, logic errors.
• Misconfigurations: Default credentials, open ports, excessive permissions.
• Design flaws: Weak cryptography, missing authentication.
• Human factors: Social engineering susceptibility, weak passwords.
• Zero-days: Unknown vulnerabilities with no available patch.

Vulnerability management process

• Asset inventory: Know what you have to protect.
• Scanning: Regular automated vulnerability assessments.
• Prioritization: Risk-based ranking considering asset criticality and exploitability.
• Remediation: Patching, configuration changes, or compensating controls.
• Verification: Confirm vulnerabilities are actually fixed.
• Reporting: Track metrics and communicate risk to leadership.