4.1 Vulnerability management
📘CompTIA Security+ (SY0-701)
After you identify vulnerabilities in systems, applications, or networks, the next step is analysis. Analysis is all about understanding what each vulnerability really means, how dangerous it is, and what should be done first.
Here’s what you need to focus on:
1. Confirming False Positives and False Negatives
- False Positive: A scan or tool says there’s a vulnerability, but in reality, there isn’t one.
- Example: A vulnerability scanner flags a web server as having an outdated SSL certificate, but upon checking, the certificate is actually up-to-date.
- False Negative: A scan misses a real vulnerability.
- Example: A vulnerability scanner doesn’t detect a misconfigured firewall rule that allows unwanted traffic.
Why it matters: You don’t want to waste time fixing problems that don’t exist (false positives), and you don’t want to leave real vulnerabilities open (false negatives).
2. Prioritization
Once you know which vulnerabilities are real, you need to prioritize them. Not all vulnerabilities are equally dangerous. Factors for prioritization include:
- Severity of the vulnerability (how bad it is if exploited)
- Ease of exploitation (how easy it is for an attacker to take advantage)
- Importance of the affected system (critical servers are higher priority than a test server)
Example in IT: A vulnerability in a domain controller (manages all user accounts) is more critical than the same vulnerability on a rarely used file server.
3. CVSS (Common Vulnerability Scoring System) and CVE (Common Vulnerabilities and Exposures)
CVSS
- A standard scoring system used to rate the severity of a vulnerability.
- Scores range 0.0 to 10.0:
- 0.0 – 3.9 → Low severity
- 4.0 – 6.9 → Medium severity
- 7.0 – 8.9 → High severity
- 9.0 – 10.0 → Critical severity
Example: A SQL injection vulnerability in a database may get a CVSS score of 9.1 → critical.
CVE
- A unique identifier for a known vulnerability.
- Example: CVE-2025-12345 identifies a specific software flaw in a particular version of a web application.
How CVSS and CVE work together:
- CVE identifies the vulnerability.
- CVSS scores it to show how urgent it is to fix.
4. Classification
Classifying vulnerabilities helps organize them based on type and potential impact. Common categories include:
- Software vulnerabilities – bugs in applications (e.g., outdated software, buffer overflows)
- Hardware vulnerabilities – flaws in devices (e.g., CPUs, network cards)
- Configuration vulnerabilities – incorrect setup of servers or applications (e.g., open ports, weak passwords)
Purpose: Classification makes it easier for teams to decide who fixes it and how quickly.
5. Exposure Factor
- Definition: Measures how much damage a vulnerability could cause to a system if it’s exploited.
- Expressed as a percentage of loss to the system’s value.
Example in IT:
- A vulnerability in a database storing 100,000 user accounts might have a high exposure factor if exploited because it risks leaking a lot of sensitive data.
6. Organizational Impact
- Measures how a vulnerability affects the organization.
- Consider these areas:
- Confidentiality → Could data be leaked?
- Integrity → Could data be changed maliciously?
- Availability → Could services go down?
Example:
- A web server vulnerability could let attackers modify website content (integrity) or crash the website (availability).
7. Risk Tolerance
- Definition: How much risk an organization is willing to accept before taking action.
- Organizations with low risk tolerance patch every vulnerability quickly.
- Organizations with high risk tolerance may delay patching some low-risk vulnerabilities due to cost or operational impact.
Example in IT:
- A company that handles medical records (highly regulated) will have low risk tolerance—even medium-level vulnerabilities need quick fixes.
- A company running a small internal test system might tolerate some low-risk vulnerabilities.
Summary
In simple terms, vulnerability analysis is like triaging IT problems:
- Check results carefully → eliminate false positives, find false negatives.
- Prioritize based on danger → focus on the most critical vulnerabilities first.
- Use CVSS/CVE → CVE names the problem, CVSS scores the danger.
- Classify → group by type for easier handling.
- Estimate exposure factor → understand potential damage.
- Measure organizational impact → see what is affected.
- Consider risk tolerance → decide which vulnerabilities must be fixed immediately.
By following these steps, IT teams can focus resources efficiently and reduce security risk effectively.
