Vulnerability Remediation
- •
def
- •
the process of fixing or otherwise managing an identified vulnerability
- •
- •
techniques
- •
Patching — the most common mitigation, applied on a scheduled (monthly/quarterly) or unscheduled (zero-day, urgent) basis
- •
Risk Tolerance — the amount of risk an organization is willing to accept; patching immediately doesn't allow time for testing, but delaying testing leaves the system vulnerable in the meantime
- •
Segmentation (Network) — limiting the scope of a potential exploit by isolating devices into their own networks/VLANs; may include air-gapping if a system can't be patched at all
- •
Compensating Control — used when the optimal fix (a patch, an internal firewall) isn't available yet; e.g., disabling the problematic service or revoking access until a proper fix ships
- •
exceptions and exemptions — a formal, approved process for cases where a vulnerability can't be fully remediated (may depend on required local login, physical access, or other mitigating criteria)
- •
- •
validating remediation
- •
rescanning, auditing remediated systems, and manual verification, to confirm the patch was actually applied and actually stops the exploit
- •
- •
reporting
- •
ongoing, continuous reporting on identified vulnerabilities, patched vs. unpatched systems, and new threat notifications — difficult to manage without automation
- •
- •