Group 10: Vulnerability Management

What is vulnerability management?

The continuous process of discovering, assessing, prioritizing, remediating, and validating security weaknesses.

What is a CVE?

A standardized identifier assigned to a publicly known vulnerability.

What is CVSS?

A scoring framework used to describe the technical severity of a vulnerability.

What is EPSS?

A score estimating the probability that a vulnerability will be exploited in the near term.

What is the CISA Known Exploited Vulnerabilities catalog?

A list of vulnerabilities with evidence of active exploitation that organizations should prioritize.

What is an authenticated vulnerability scan?

A scan that logs into a target system to inspect installed software, missing patches, and local configurations.

What is an unauthenticated vulnerability scan?

A scan performed without credentials that primarily evaluates externally visible services and weaknesses.

Why are authenticated scans usually more accurate?

They provide deeper visibility into software versions, patches, configurations, and local vulnerabilities.

What is the difference between a vulnerability scan and a penetration test?

A vulnerability scan identifies possible weaknesses broadly, while a penetration test actively validates exploitability and attack paths.

What is asset criticality?

The importance of an asset to business operations, sensitive data, safety, revenue, or essential services.

Why should vulnerabilities not be prioritized only by CVSS?

Priority should also consider active exploitation, asset criticality, internet exposure, exploitability, available controls, and business impact.

What is vulnerability remediation?

Fixing or removing the condition that creates the vulnerability.

What is a compensating control?

An alternate safeguard used when the preferred remediation cannot be implemented immediately.

What is risk acceptance?

A documented decision to tolerate a known risk after its likelihood, impact, and available options are evaluated.

What is a vulnerability exception?

An approved decision to temporarily defer, accept, or exclude a specific vulnerability finding.

What is a remediation SLA?

The required timeframe for addressing a vulnerability based on severity, risk, or policy.

What is remediation validation?

Confirming through rescanning or manual evidence that a vulnerability was successfully fixed.

How should a suspected false-positive vulnerability be investigated?

Review the scanner evidence, verify the installed version and patch status, check vendor information, validate manually when possible, and rescan.

Why might an authenticated scan fail?

Incorrect credentials, insufficient permissions, network restrictions, disabled services, endpoint controls, or configuration problems.

What should happen when a critical vulnerability cannot immediately be patched?

Apply compensating controls, restrict exposure, increase monitoring, document the risk, create a remediation plan, and obtain appropriate approva