4.1 Vulnerability management
📘CompTIA Security+ (SY0-701)
Once vulnerabilities are identified in your systems (through scans, threat intelligence, or testing), the next step is response. Response means taking action to reduce risk, protect the system, and prevent exploitation. There are several key ways to respond:
1. Patching
Definition:
Patching is updating software, operating systems, or firmware to fix security issues.
Why it matters:
Most vulnerabilities exist because software has flaws. Patches remove these flaws before attackers can exploit them.
IT examples:
- Installing Windows Updates to fix security holes.
- Updating the Apache web server to patch a known vulnerability.
- Applying firmware updates to network routers to prevent exploits.
Key points for the exam:
- Patch management should be regular and automated where possible.
- Prioritize patches for critical vulnerabilities first.
- Some systems may need testing before patching to avoid breaking applications.
2. Cyber Insurance
Definition:
Cyber insurance is a financial policy that helps cover losses if a security incident occurs.
Why it matters:
Even with strong security, some attacks may succeed. Insurance helps mitigate financial and operational impact.
IT examples:
- A ransomware attack encrypts critical data; insurance may cover costs of recovery and lost revenue.
- Data breach exposes customer information; insurance can cover legal fees and notification costs.
Key points for the exam:
- Insurance is not a replacement for security controls—it’s a risk transfer strategy.
- Policies vary, so organizations must understand what is covered and what isn’t.
3. Segmentation
Definition:
Segmentation divides a network into smaller, isolated sections to limit access and reduce risk.
Why it matters:
If a vulnerability is exploited in one segment, it prevents attackers from moving freely across the entire network.
IT examples:
- Separating the finance network from the general corporate network.
- Creating separate VLANs for employees, guest Wi-Fi, and servers.
- Isolating critical databases from public-facing web servers.
Key points for the exam:
- Segmentation helps contain breaches and reduce attack surface.
- Can be physical (different switches) or logical (VLANs, subnets).
4. Compensating Controls
Definition:
Compensating controls are temporary or alternative security measures when a vulnerability cannot be fixed immediately.
Why it matters:
Some systems cannot be patched right away due to compatibility, testing, or operational reasons.
IT examples:
- Placing a firewall rule to block access to a vulnerable service.
- Limiting access to a vulnerable server to only certain administrators.
- Using intrusion detection systems (IDS) to monitor for exploitation attempts.
Key points for the exam:
- They are not permanent fixes, but help reduce risk until a proper solution is applied.
- Often required for legacy systems or critical applications that can’t be immediately updated.
5. Exceptions
Definition:
Exceptions are officially approved decisions not to patch or fix a vulnerability immediately, usually due to operational or business needs.
Why it matters:
Sometimes fixing a vulnerability may break essential systems or services. Exceptions are documented so that the organization accepts the risk consciously.
IT examples:
- A specialized industrial application cannot run after a patch; the organization documents an exception and uses compensating controls.
- Critical legacy software that can’t be updated; exception approval is logged and reviewed regularly.
Key points for the exam:
- Exceptions must be documented and approved by management.
- Risk acceptance should be temporary, with periodic review.
- Often paired with compensating controls to reduce exposure.
Summary Table for Easy Exam Recall
| Response Method | What it Does | IT Example | Exam Tip |
|---|---|---|---|
| Patching | Fixes vulnerabilities | Update Windows or Apache server | Always prioritize critical patches |
| Insurance | Transfers financial risk | Ransomware recovery costs | Not a replacement for security |
| Segmentation | Limits attacker movement | Separate VLANs for finance vs. guest Wi-Fi | Can be physical or logical |
| Compensating Controls | Temporary protection when patching isn’t possible | Firewall rules, access restrictions, IDS | Reduces risk until proper fix applied |
| Exceptions | Officially accept risk for business reasons | Legacy software can’t be patched; risk is documented | Must be approved & reviewed |
✅ Exam Tip:
- CompTIA often asks which method reduces risk when a patch can’t be applied → answer: compensating controls.
- Questions may also test your understanding of segmentation vs. patching.
- Remember: Insurance = financial risk management, not a technical fix.
