Principles of Information Security: Vulnerability Management (Scanning, CVSS, Patch Management)

Vulnerability Management (Scanning, CVSS, Patch Management)

Vulnerability Management Study Guide

(Scanning, CVSS, Patch Management – Exam-Ready & Practical)

What This Is

Vulnerability Management is the continuous process of identifying, evaluating, prioritizing, and remediating security weaknesses in systems, software, and networks before attackers exploit them. It’s critical because unpatched vulnerabilities are the #1 cause of breaches—e.g., the 2017 Equifax breach (147M records exposed) happened because a Struts2 vulnerability (CVE-2017-5638) wasn’t patched for 2 months, despite a fix being available. Without vulnerability management, even basic attacks (like ransomware via EternalBlue, CVE-2017-0144) can cripple organizations.

Key Terms & Concepts

• Vulnerability: A weakness in a system (e.g., outdated software, misconfigured firewall) that could be exploited. Example: Log4j (CVE-2021-44228) allowed remote code execution via a simple string in logs.
• CVE (Common Vulnerabilities and Exposures): A publicly disclosed list of vulnerabilities (e.g., CVE-2023-1234) maintained by MITRE. Tool: NVD (National Vulnerability Database) for details.
• CVSS (Common Vulnerability Scoring System): A 0–10 scale (10 = critical) to rate vulnerability severity. Uses Base (exploitability + impact), Temporal (time-based), and Environmental (org-specific) metrics. Example: Heartbleed (CVE-2014-0160) had a CVSSv2 score of 5.0 (Medium) but was later upgraded to 7.5 (High) in CVSSv3.
• Vulnerability Scanning: Automated (Nessus, OpenVAS, Qualys) or manual (Burp Suite, Nmap) checks to find weaknesses. Types: Authenticated (credentialed) vs. Unauthenticated (black-box).
• Penetration Testing (vs. Scanning): Simulated attack (by humans) to exploit vulnerabilities, while scanning is automated detection. Standards: PTES, OWASP Testing Guide.
• Patch Management: The process of deploying updates (patches) to fix vulnerabilities. Example: Microsoft’s "Patch Tuesday" (2nd Tuesday of the month).
• Risk Acceptance: Deliberately not fixing a vulnerability (e.g., legacy system too costly to upgrade). Must be documented and approved by management.
• False Positive: A scanner reports a vulnerability that doesn’t exist (e.g., outdated signature). Fix: Manual verification (e.g., exploit testing).
• False Negative: A scanner misses a real vulnerability (e.g., zero-day). Mitigation: Use multiple scanners + threat intelligence.
• Exploit: Code or technique that takes advantage of a vulnerability. Example: Metasploit modules for EternalBlue.
• Zero-Day: A vulnerability unknown to the vendor (no patch available). Example: Stuxnet exploited 4 zero-days in Windows.
• SCAP (Security Content Automation Protocol): NIST standard for automating vulnerability management (e.g., CVE, CVSS, CPE). Tools: OpenSCAP, Tenable.sc.

Step-by-Step / Process Flow

1. Asset Inventory & Discovery

• Goal: Know what you’re protecting (servers, endpoints, IoT, cloud).
• How:
• Use automated tools (Nmap, Lansweeper, AWS Config) to scan networks.
• Tag assets (e.g., "PCI-DSS in-scope," "HR database").
• Document OS, software versions, and owners.
• Why? You can’t patch what you don’t know exists.

2. Vulnerability Scanning

• Goal: Find weaknesses in assets.
• How:
• Schedule scans (weekly/monthly, during low-traffic hours).
• Run authenticated scans (more accurate) and unauthenticated (attacker’s view).
• Use multiple tools (Nessus + OpenVAS + Burp Suite for web apps).
• Compare results to avoid false positives/negatives.
• Tip: Exclude sensitive systems (e.g., medical devices) if scanning could crash them.

3. Prioritization (CVSS + Risk-Based)

• Goal: Fix the most critical vulnerabilities first.
• How:
• Score vulnerabilities using CVSS (Base + Temporal + Environmental).
• Adjust for business impact (e.g., a "Medium" CVSS bug in a payment system = "Critical").
• Use threat intelligence (e.g., if CISA warns about active exploits for CVE-X, prioritize it).
• Document exceptions (e.g., "Can’t patch legacy ERP—mitigated with WAF").
• Example: A CVSS 9.8 (Critical) in a public-facing web server > CVSS 7.5 in an internal test system.

4. Remediation (Patch Management)

• Goal: Fix or mitigate vulnerabilities.
• How:
• Patch (apply vendor updates) or workarounds (e.g., disable vulnerable service).
• Test patches in a staging environment first (to avoid breaking production).
• Deploy in phases (e.g., non-critical servers → critical servers).
• Automate (WSUS, SCCM, Ansible, Chef) for speed.
• Warning: Reboot requirements can delay patching (e.g., Windows updates).

5. Verification & Reporting

• Goal: Confirm fixes worked and document for audits.
• How:
• Rescan to verify vulnerabilities are closed.
• Generate reports for management (e.g., "Reduced critical vulnerabilities by 40%").
• Track metrics (e.g., "Mean Time to Patch" < 30 days).
• Compliance: Required for PCI-DSS (Req. 6.2), ISO 27001 (A.12.6.1), NIST SP 800-40.

6. Continuous Monitoring

• Goal: Detect new vulnerabilities between scans.
• How:
• Enable auto-updates for scanners (e.g., Nessus plugins).
• Subscribe to threat feeds (CISA KEV, MITRE ATT&CK, OWASP Top 10).
• Integrate with SIEM (e.g., Splunk alerts for new CVEs in your environment).

Common Mistakes

Certification Exam Tips

CISSP

• Focus: Risk management, governance, and process (not technical details).
• Tricky Question: "Which CVSS metric is most important for prioritization?"
• Answer: Environmental (because it accounts for business impact).
• Management Trap: Expect questions on risk acceptance (e.g., "When is it okay to not patch?").

Security+

• Focus: Tools (Nessus, Nmap), CVSS basics, and patch management steps.
• Tricky Question: "What’s the difference between a vulnerability scan and a penetration test?"
• Answer: Scanning = automated detection; pentest = manual exploitation.
• Port/Protocol Trap: Know Nessus (TCP 8834), OpenVAS (TCP 9390).

CEH

• Focus: Exploiting vulnerabilities (Metasploit, Burp Suite) and evading scans.
• Tricky Question: "How can an attacker bypass a vulnerability scanner?"
• Answer: Fragmentation, encryption, or timing attacks (e.g., slow scans to avoid IDS).
• Tool Trap: Know Nmap flags (-sV for version detection, -O for OS fingerprinting).

Quick Check Questions

1. (Security+ Style)

Your team runs a vulnerability scan and finds CVE-2023-4567 (CVSS 9.1) in a public-facing web server. The vendor released a patch 30 days ago, but the server hasn’t been updated. What’s the FIRST step in remediation? - A) Immediately apply the patch in production.
- B) Test the patch in a staging environment.
- C) Accept the risk and document the exception.
- D) Disable the web server until the patch is applied.

✅ Answer: B
Explanation: Always test patches in staging first to avoid breaking production (e.g., patch might conflict with custom code).

2. (CISSP Style)

A legacy medical device (running Windows XP) has a critical vulnerability (CVE-2023-1234, CVSS 10.0). Patching would require FDA recertification, which takes 6 months. What’s the BEST risk response? - A) Patch immediately and accept the compliance violation.
- B) Isolate the device on a segmented network and add compensating controls (e.g., IPS).
- C) Ignore the vulnerability since it’s a legacy system.
- D) Replace the device with a newer model.

✅ Answer: B
Explanation: Isolation + compensating controls (e.g., IPS, network segmentation) mitigate risk while waiting for recertification.

3. (CEH Style)

An attacker wants to evade detection while scanning a target network. Which Nmap technique would BEST avoid triggering an IDS? - A) -T4 (aggressive timing) - B) -f (fragmentation) - C) -sV (version detection) - D) -O (OS fingerprinting)

✅ Answer: B
Explanation: Fragmentation (-f) splits packets to evade signature-based IDS/IPS.

Last-Minute Cram Sheet

1. Vulnerability Management = Identify → Prioritize → Remediate → Verify → Monitor.
2. CVSS: 0–10 scale; Base (exploitability + impact) + Temporal + Environmental.
3. CVE: Public vulnerability list (MITRE); NVD provides details.
4. False Positive: Scanner says "vulnerable" but isn’t. False Negative: Scanner misses a real bug. ⚠️
5. Patch Management: Test → Deploy → Verify. WSUS/SCCM automate Windows patches.
6. Nessus: TCP 8834; OpenVAS: TCP 9390. ⚠️ (Security+ loves port questions.)
7. Zero-Day: No patch available. Exploit: Code that takes advantage of a vulnerability.
8. Risk Acceptance: Documented decision to not fix a vulnerability (e.g., legacy system).
9. SCAP: NIST standard for automating vulnerability management (CVE, CVSS, CPE).
10. PCI-DSS Req. 6.2: Patch critical vulnerabilities within 1 month. ⚠️ (CISSP loves compliance.)