What Is Vulnerability Management?

Vulnerability management has been variably described as computer security management activity or web application security that can be as simple or as complex as you wish. From the simplistic view that a computer system can be secure by simply downloading frequent patches from Microsoft, to the more complex view taken by some organisations, that vulnerabilities need to be approached with a complex and systematic array of procedures.

Whichever view you take, it is clear that in the modern marketplace computer networks should make it easier to communicate with customers and suppliers with security and safety. With this expectation in mind however threats from worms and viruses that pervade everyday computer activity mean that vulnerabilities in management software are exposed on almost daily basis. This fact alone indicates a need to take protective action as a defence against malicious attacks including the use of firewalls, intrusion detection systems and anti-virus software.

In fact, layers of securities are a modern trend in a proactive approach to detecting intrusions and preventing attacks.

These days, organisations can no longer relax their standards by adhering to a yearly or even quarterly audit of their systems. Vulnerabilities emerge every day and unless you have an appropriate management program that runs on a daily or weekly basis you are placing your system at risk.

In summary, a typical vulnerability management system could consist of 6 steps.

Early identification. This involves identifying every network asset including operating systems and any open services in use.
Prioritising assets. Large organisations will find it easy to categorise various assets into business units or groups and rank them in order of priority.
Assessment processes. When you have a risk profile established it is easy to focus on eliminating risks in the more important assets of your business operation. The more important the asset is, the greater the need to identify security vulnerabilities on a daily basis.
Reporting. The production of regular reports can highlight problems before they emerge and paint a picture of overall trends so that remedial action can be taken.
Remedial action. As indicated above once patterns have merged it is easy to prioritise and fix vulnerabilities as they are identified.
The final phase involves verifying that all threats have been eliminated through follow-up audits.

While this is not meant to be a definitive strategy, the steps outlined above can form the basis of an effective vulnerability management plan. But in any case the important thing to remember is that scanning technology has improved dramatically over the last 10 years and it is absolutely vital for you to get started but more importantly, to take action on the results.

If you want to dip your toes in the water but are not prepared to outlay money for sophisticated software or outsource to a specialist service, there are plenty off open source systems you can start with. The important thing to remember is that automated systems will allow you to strengthen your Web application Security and give you peace of mind you're looking for.

HackLabs is a Security Consulting Company specialising in Penetration Testing. We perform testing for our clients whom from all around the world. For more information, visit Penetration Testing.