CompTIA Security+ Preparation · lesson 19 of 45 · 25 min
Vulnerability Management Lifecycle
Vulnerability management is a continuous process of identifying, prioritizing, remediating, and verifying security weaknesses.
1. Identify — discover vulnerabilities through scanning (Nessus, Qualys, OpenVAS), penetration testing, threat intelligence feeds, vendor advisories, and bug bounty programs.
2. Prioritize — not all vulnerabilities can be patched immediately. Use CVSS (Common Vulnerability Scoring System) scores (0–10), exploitability, asset criticality, and business impact to prioritize. CVSS 9.0–10.0 = Critical, 7.0–8.9 = High, 4.0–6.9 = Medium, 0.1–3.9 = Low.
3. Remediate — apply patches, change configurations, implement compensating controls, or accept the risk. Patching is preferred; compensating controls are used when patching is not possible.
4. Verify — re-scan after remediation to confirm the vulnerability is resolved. Validate that patches did not introduce new issues.
5. Report — document findings, remediation actions, and residual risk. Supports compliance and management reporting.
Vulnerability Scanning vs Penetration Testing
Vulnerability scan — automated tool that identifies known vulnerabilities. Non-intrusive (usually). Produces a list of findings with CVSS scores. Does not exploit vulnerabilities. Run regularly (weekly/monthly).
Penetration test — authorized simulated attack. Actively exploits vulnerabilities to demonstrate real impact. Performed by skilled testers. More thorough but more expensive. Run annually or after major changes.
False positive — scanner reports a vulnerability that does not actually exist. Requires manual verification.
False negative — scanner misses a real vulnerability. More dangerous — gives false confidence.
CVE (Common Vulnerabilities and Exposures) — standardized identifier for publicly known vulnerabilities. Format: CVE-YEAR-NUMBER. Example: CVE-2021-44228 (Log4Shell).
NVD (National Vulnerability Database) — NIST database of CVEs with CVSS scores and remediation guidance.
Key Terms
Key Terms
Knowledge Check — 10 Questions
Security+ — Vulnerability Management
A CVSS score of 9.5 indicates:
- Low severity
- Medium severity
- High severity
- Critical severity
- Answer: Critical severity
CVSS 9.0–10.0 = Critical. These vulnerabilities should be patched within 24–48 hours. A false negative in vulnerability scanning means:
- A vulnerability is reported that does not exist
- A real vulnerability is missed by the scanner
- The scan completed successfully
- The CVSS score is incorrect
- Answer: A real vulnerability is missed by the scanner
False negatives are more dangerous than false positives — they give false confidence that a system is secure when it is not. Penetration testing differs from vulnerability scanning because:
- Pen testing is automated
- Pen testing actively exploits vulnerabilities to demonstrate real impact
- Vulnerability scanning is more thorough
- They are identical
- Answer: Pen testing actively exploits vulnerabilities to demonstrate real impact
Pen testers exploit vulnerabilities like real attackers — they demonstrate actual impact, not just theoretical risk. CVE-2021-44228 is the identifier for:
- Heartbleed
- Log4Shell
- EternalBlue
- Shellshock
- Answer: Log4Shell
CVE-2021-44228 is Log4Shell — a critical remote code execution vulnerability in the Log4j Java logging library. When patching is not immediately possible, the best alternative is:
- Ignore the vulnerability
- Implement a compensating control
- Delete the affected system
- Increase the CVSS score
- Answer: Implement a compensating control
Compensating controls (WAF rules, network segmentation, monitoring) reduce risk when patching is not immediately feasible. The NVD (National Vulnerability Database) is maintained by:
- Microsoft
- NIST
- MITRE
- CompTIA
- Answer: NIST
The NVD is maintained by NIST (National Institute of Standards and Technology) — it provides CVSS scores and remediation guidance for CVEs. Vulnerability management is best described as:
- A one-time project
- A continuous process of identify, prioritize, remediate, verify
- Only running vulnerability scans
- Only applying patches
- Answer: A continuous process of identify, prioritize, remediate, verify
Vulnerability management is ongoing — new vulnerabilities are discovered daily, requiring continuous scanning, prioritization, and remediation.
Which factor is used to prioritize vulnerability remediation?
- Alphabetical order
- CVSS score, exploitability, and asset criticality
- Date of discovery only
- Vendor name
Answer: CVSS score, exploitability, and asset criticality
Effective prioritization considers CVSS score, whether the vulnerability is actively exploited, and how critical the affected asset is.
CVE stands for Common _____ and Exposures.
Answer: Vulnerabilities
CVE = Common Vulnerabilities and Exposures — the standardized naming system for publicly known security vulnerabilities.
After remediating a vulnerability, the next step is:
- Document and close
- Re-scan to verify the vulnerability is resolved
- Increase the CVSS score
- Notify the vendor
- Answer: Re-scan to verify the vulnerability is resolved
Verification is essential — re-scan to confirm the patch worked and did not introduce new issues.
Previous lesson: Network attacks: DoS/DDoS, on-path, replay, DNS poisoning, ARP spoofing
Back to CompTIA Security+ Preparation
Next lesson: Penetration testing concepts: reconnaissance, exploitation, post-exploitation, reporting