What is vulnerability management?

Vulnerability management is an ongoing process that involves identifying, assessing, prioritizing, and remediating or mitigating security exposures within IT infrastructure and software. It’s an essential component of IT risk management aimed at protecting an organization’s systems from cyberattacks, which can result in costly data loss and theft.

The ongoing, dynamic process requires vigilance and adaptability. By following a structured approach and harnessing advanced technologies and intelligence, organizations can continually improve their proactive defenses, enhance their cybersecurity postures, and better protect their digital assets and people from ever-evolving cyberthreats.

Why is vulnerability management important?

Cyber vulnerabilities are weaknesses in workflow, software, or systems that cybercriminals can exploit to gain unauthorized access, cause disruptions, steal sensitive data, or hold data for ransom. Having a strong vulnerability management strategy bolstered by an associated technology solution or service gives organizations continuous, comprehensive visibility into exposures in their IT environments. Armed with this visibility and real-time threat intelligence, businesses can identify existing gaps in their cybersecurity defenses, rank vulnerabilities in priority order for remediation or mitigation, and efficiently shrink their attack surface.

In this way, vulnerability management allows organizations to be proactive in their cyber defenses, helping them find, manage, and mitigate risks before they become business-impacting incidents or breaches.

What are the stages of the vulnerability management lifecycle?

There are five primary, ongoing actions involved in vulnerability management programs:

1. Discover. This initial stage involves using automated tools such as vulnerability scanners, which monitor all IT systems, software, endpoints, and other digital assets, to uncover potential security weaknesses in your organization.
2. Assess. Once you find a vulnerability, it’s important to evaluate the degree of risk it poses and its potential impact on the organization if exploited. Using threat intelligence sources and the standard Common Vulnerability Scoring System framework, you can categorize and prioritize discovered vulnerabilities based on their criticality.
3. Remediate, mitigate, or accept. This practice involves deciding how to address the discovered and assessed vulnerabilities in one of three primary ways: 1) remediation, which fully resolves the vulnerability, often through software patching; 2) mitigation, which reduces the potential impact of an exploit; or 3) acceptance, which leaves low-risk vulnerabilities unaddressed in deference to more critical priorities. It's common, for example, for organizations to transfer “tolerated” risk to a cyber insurance provider to help mitigate financial losses, cover ransomware costs, and enhance overall cyber defenses effectively.
4. Reassess and validate. This step uses continuous scanning and periodic testing to verify that the measures implemented to address a vulnerability are effective and haven’t introduced new vulnerabilities.
5. Report. Effective vulnerability management includes robust reporting mechanisms. Reporting provides insights into metrics, trends, and remediation efforts, ensuring timely updates, accountability, and ongoing improvements to a company’s security posture.

What are some best practices for building and implementing a vulnerability management strategy?

Organizations that lack the resources, skills, and experience for effective vulnerability management should consider subscribing to a managed service as the quickest route to improving their cybersecurity posture. Those fortunate enough to have substantial internal cybersecurity resources should begin by customizing their vulnerability management approach to their organization’s needs.

Each business has unique constraints and requirements that influence what constitutes acceptable detection, mitigation, and remediation time frames, and your company should create a strategy that reflects these requirements. In addition, it pays to keep the big picture in mind; for example, fully evaluate whether you have sufficiently mitigated a specific risk rather than focusing on checking off a box for a routine fix, such as applying a software patch.

Any vulnerability management strategy should incorporate the following components:

• Regular scanning and monitoring
• Ongoing employee training and awareness
• Integration with other security systems for broad correlation and detection
• Effective, regular software patch management

Moreover, Gartner recommends these four best practices:

1. Align vulnerability management policies and action items with your organization's risk appetite
2. Prioritize vulnerabilities based on risk and current exploitation activity
3. Use a combination of compensating controls and remediation solutions
4. Take advantage of automation to enhance analysis and remediation efficiency

What is risk-based vulnerability management?

A risk-based approach to vulnerability management prioritizes exposures based on the specific risks they pose to the organization rather than on the exclusive use of general severity scores. Such a strategy combines stakeholder-specific data with AI to provide more accurate risk assessments, helping organizations focus on the most critical vulnerabilities.

This type of approach has two primary tenets to keep in mind:

• Focus your priorities. Concentrate mainly on reducing risk over time rather than attempting to eliminate every vulnerability. Prioritize and address the most critical threats to improve overall security.
• Integrate decisions and actions. Security decisions should be integrated into each of the five stages of the vulnerability management lifecycle (see “What are the stages of vulnerability management?” above). This ensures that informed actions are taken to mitigate risks effectively.

What are common classifications, types, and examples of vulnerabilities?

Vulnerabilities are categorized into four main types: network, operating system, process, and human. Each category reflects different sources of potential security weaknesses. Note also that the rise of cloud computing has introduced additional vulnerabilities. These are often created by misconfigurations that can lead to unauthorized access to cloud resources.

Classification severity is based generally on a vulnerability’s threat level. However, internal business context and specific security risks also play crucial roles in determining the potential impact of an exploited vulnerability on a given organization.

Let’s look at a few examples of specific types of vulnerabilities and possible safeguards against attempts to exploit them.

Network example

• Vulnerability: Unsecured Wi-Fi networks can be exploited by attackers who intercept data in transit or gain unauthorized access to connected devices. Poorly configured firewalls and open ports also pose significant risks.
• Protection: Implement robust encryption protocols like WPA3 for over-the-air Wi-Fi network traffic and use strong SSID passwords. Ensure that firewalls are properly configured to block unauthorized access. Regularly update network hardware and firmware and use intrusion detection/prevention systems (IDS/IPS).

Operating system example

• Vulnerability: Outdated operating systems with unpatched security flaws can be exploited by malware or hackers. For instance, vulnerabilities like EternalBlue in older versions of Windows were exploited by the WannaCry ransomware.
• Protection: Keep operating systems up to date with the latest security patches. Enable automatic updates and use reputable antivirus software. Implement least-privilege/network trust principles to limit user permissions and reduce potential attack surfaces.

Application example

• Vulnerability: SQL injection vulnerabilities in web applications allow attackers to execute arbitrary SQL code, potentially accessing or modifying sensitive database information. Cross-site scripting (XSS) is another common application vulnerability in which malicious scripts are injected into otherwise trusted websites.
• Protection: Perform regular code reviews and security testing, including penetration testing and static code analysis. Use parameterized queries to prevent SQL injection and implement Content Security Policy (CSP) standards to mitigate XSS attacks

Human factor example

• Vulnerability: Phishing attacks, often launched via email, exploit human errors by tricking users into disclosing sensitive information like passwords and financial details. Social engineering tactics can also manipulate employees into granting unauthorized access to their companies’ systems.
• Protection: Conduct regular security awareness training for employees to recognize and avoid phishing and social engineering attacks. Implement multifactor authentication (MFA) to add another layer of security beyond just passwords.

What are some of the latest trending cybersecurity threats?

Data protection is the greatest cybersecurity risk facing organizations of all sizes. In the Sophos 2024 Threat Report: Cybercrime on Main Street, more than 90% of attacks reported by customers involved data or credential theft. Here is a summary of common methods used in cyberattacks, data extortion, unauthorized remote access, and data theft.

• Ransomware. The impact of ransomware is substantial, frequently targeting small and midsize businesses (SMBs) across various sectors.
• Cybercrime as a service (CCaaS) and malware as a service (MaaS). These exploits remain prevalent, with cybercriminals using delivery frameworks provided through underground marketplaces. Improvements in platform security and takedown operations by law enforcement have helped diminish CCaaS/MaaS, but they remain persistent threats.
• Dual-use tools (“living off the land” attacks). Tools like Cobalt Strike, initially developed for security testing, are often misused by attackers. Other dual-use tools, such as remote desktop software, file compression utilities, and open-source security testing tools, are also used by cybercriminals to streamline their malicious activities and bypass preventive security tools.
• Zero-day and non-zero-day vulnerabilities and attacks. Both types of threats are dangerous and can be severe. Non-zero-day attacks target known software vulnerabilities that may not have been patched by all users. A zero-day vulnerabilityis a software exposure discovered by attackers before the vendor is aware of it, so no patch exists for it. A zero-day attack, then, exploits that vulnerability before there has been time for a fix or patch. Attackers might deploy persistent web shells, maintaining unauthorized access even after patches are applied, which underscores the need for proactive security measures and timely updates to mitigate these vulnerabilities.
• Supply chain attacks. Organizations must be wary of supply chain attacks, which have become a regular part of ransomware strategies. Attacks on managed service providers highlight the importance of securing third-party services integral to business operations.
• Malicious email. Despite advancements in communication technology, email remains a formidable threat vector. Creative tactics include impersonating delivery service workers to coax enterprise customers into opening malicious emails. Weaponized PDFs, often linking to malicious scripts or sites, are also making a comeback, sometimes incorporating embedded QR codes.
• Mobile malware and social engineering threats. Small businesses rely heavily on mobile devices for critical operations, including messaging, cloud services, and mobile point-of-sale applications. Cybercriminals exploit this dependence by making mobile devices and users targets of their malware. Their malicious applications often masquerade as legitimate apps on Google Play or third-party stores, particularly as mobile lending apps. Malware is also often distributed via links sent through text messages, aiming to access sensitive data or commit fraud. Organizations must stay vigilant against these malware and social engineering threats to protect their essential systems and data.

What are examples of vulnerabilities and exploits?

The following are considered high risk due to their potential impact and exploitation frequency.

• Remote code execution. An attacker exploits vulnerabilities in web applications and network infrastructure to run malicious code on a target system. The cybercriminal accomplishes this by exploiting a buffer overflow vulnerability to gain control of a server.
• Hard-coded credentials. Embedded credentials in software can be easily exploited if discovered. A common vulnerability, for example, is the default admin password in IoT devices that users often neglect to change.
• Denial of service (DoS) and distributed denial of service (DDoS). A computer is used to flood a server with data packets (DoS) or multiple computers bombard a target network with packets (DDoS), disrupting or crashing services and rendering them inaccessible to legitimate users. Examples are an ICMP flood or Smurf attack, which involves a computer sending out spoofed packets that ping every computer on the targeted network and trigger them to respond to the targeted server. The result is amplified traffic that potentially overwhelms the target host device(s) so that it can no longer serve legitimate requests.
• Directory traversal. A vulnerability in a web application server, created by an HTTP exploit, gives attackers access to restricted directories by manipulating URL parameters to read sensitive files outside the web root directory.
• Privilege escalation. Attackers exploit a software bug, a design flaw, or configuration oversight to gain higher-level access than intended. They accomplish this by executing commands with administrative privileges through the use of stolen credentials to access a host system with privileges, identifying a file server on the network with sensitive data, and modifying those files.

How are vulnerability remediation, mitigation, and software patching related?

Software patching is a primary means of rectifying vulnerabilities, and it involves updating operating system or application software to fix identified security flaws or bugs. For example, when a new vulnerability is discovered in an operating system, a patch is released to address this specific issue and prevent exploitation, directly remediating the issue. Mitigation, on the other hand, involves implementing temporary workarounds to reduce the risk if a patch is not yet available, such as disabling a vulnerable feature or applying access controls.

Remediation—by software patching and other means—and mitigation are both essential elements of a comprehensive vulnerability management program. Together, they help maintain robust security and reduce the risk of exploitation.

What’s the difference between vulnerability assessment and vulnerability management?

Vulnerability assessment is a specific activity within the broader scope of vulnerability management. A vulnerability assessment often refers to a one-time project conducted to uncover weaknesses in a company’s IT environment and generate recommendations for quantifying the risks they pose, prioritizing treatment of them, and mitigating or remediating them. Vulnerability management refers to an ongoing, structured lifecycle process that includes these assessment functions plus the actual remediation, mitigation, and reporting components of the five-stage vulnerability management strategy described earlier. Together, they form a comprehensive approach to cybersecurity, balancing immediate detection and response with long-term strategic management.

What is external attack surface management (EASM)?

External attack surface management (EASM) is a cybersecurity strategy focused on the advanced identification and classification of internet-facing assets. These assets may include web and email servers, web applications, and public-facing API endpoints. With the modern attack surface expanding beyond traditional on-premises IT boundaries, organizations often have numerous external assets that are unpatched or under-protected, leaving them vulnerable to cyberattacks.

EASM helps organizations continuously discover and assess these external assets to help ensure that they’re not exploited by cybercriminals. By providing comprehensive visibility and actionable insights, EASM enhances security posture, proactively identifying vulnerabilities, misconfigurations, and exposed assets. This proactive approach is essential in mitigating risks and safeguarding against potential threats associated with publicly accessible systems.

Sophos Managed Risk, Sophos’ attack surface vulnerability management service, launched in partnership with Tenable, exemplifies the EASM approach by using automation and threat intelligence to aid in prioritizing and addressing risks across the external attack surface.

What is threat intelligence, and what is its role in vulnerability management?

Threat intelligence is information gathered from distributed networked sources about live or potential attacks against an organization. As such, it’s a key component of effective vulnerability management. It provides real-time context about active and possible threats, helping organizations identify which vulnerabilities have been actively exploited. Integrating threat intelligence into vulnerability management helps in proactive defense, prioritization of critical vulnerabilities, and comprehensive risk assessment, ultimately strengthening an organization's cybersecurity defenses.

For example, if threat intelligence reveals active exploitation of a specific vulnerability, organizations can prioritize patching of that vulnerability over others. This targeted approach ensures that resources focus on mitigating the most pressing risks, understanding adversaries' tactics, and improving defense strategies.

How can automation and orchestration enhance vulnerability management programs?

Automation plays a crucial role in enhancing vulnerability management programs by using software to handle repetitive tasks, such as scanning and identifying vulnerabilities across an organization's IT infrastructure. In this way, it allows for more consistent and efficient detection of potential security issues. Additionally, orchestration coordinates IT processes and workflows to help ensure that these tasks are managed effectively, further strengthening an organization's resilience against cyberthreats. By automating these processes, organizations can discover vulnerabilities more quickly and accurately, reducing the risk of cyberattacker exploitation.

Why is a managed service recommended over standalone automated tools for vulnerability management?

While automated vulnerability scanning tools are widely available and can perform repetitive tasks efficiently, many organizations struggle to derive value from the output due to a lack of resources or expertise. Automated tools alone lack the human element and expertise often required to follow through with a comprehensive analysis and decision-making. Human expertise is where a managed service, such as Sophos Managed Risk, becomes beneficial. A managed service allows organizations to outsource their vulnerability management to experienced experts who can interpret the scan results, prioritize risks, and recommend effective remediation strategies. This approach ensures that organizations not only identify vulnerabilities but also address them effectively by capitalizing on both automation and human expertise.

Related resources

What is attack surface management? | A Sophos "Cybersecurity Explained" article

Sophos partners with Tenable to launch new Sophos Managed Risk service | Press release, April 3, 2024

Sophos guide to cyber insurance | A Sophos white paper (registration required)

Related security topic: What is cyber risk management?