Vulnerability management
 | This article needs additional citations for verification. (June 2013) |
Vulnerability management is the "cyclical practice of identifying, classifying, prioritizing, remediating, and mitigating" software vulnerabilities.[1] Vulnerability management is integral to computer security and network security, and must not be confused with Vulnerability assessment[2].[promotional source?]
Vulnerabilities can be discovered with a vulnerability scanner, which analyzes a computer system in search of known vulnerabilities,[3] such as open ports, insecure software configurations, and susceptibility to malware infections. They may also be identified by consulting public sources, such as NVD, or subscribing to a commercial vulnerability alerting service such as Symantec's DeepSight Vulnerability Datafeed[4][promotional source?] or Accenture's Vulnerability Intelligence Service[5].[promotional source?] Unknown vulnerabilities, such as a zero-day,[3] may be found with fuzz testing, which can identify certain kinds of vulnerabilities, such as a buffer overflow with relevant test cases. Such analysis can be facilitated by test automation. In addition, antivirus software capable of heuristic analysis may discover undocumented malware if it finds software behaving suspiciously (such as attempting to overwrite a system file).
Correcting vulnerabilities may variously involve the installation of a patch, a change in network security policy, reconfiguration of software, or educating users about social engineering.
See also
References
- ^ Foreman, P: Vulnerability Management, page 1. Taylor & Francis Group, 2010. ISBN 978-1-4398-0150-5
- ^ "Vulnerability Assessments vs. Vulnerability Management". Hitachi Systems Security | Managed Security Services Provider. 2018-02-19. Retrieved 2018-08-04.
- ^ a b Anna-Maija Juuso and Ari Takanen Unknown Vulnerability Management, Codenomicon whitepaper, October 2010 [1].
- ^ "DeepSight Technical Intelligence | Symantec". www.symantec.com. Retrieved 2018-12-05.
- ^ www.accenture.com https://www.accenture.com/t20170721T105740Z__w__/us-en/_acnmedia/PDF-57/Accenture-IDefense-Vulnerability-Intelligence.pdf. Retrieved 2018-12-05.
{{cite web}}: Missing or empty|title=(help)
External links
- "Implementing a Vulnerability Management Process". SANS Institute.