A vulnerability is a weakness that could be exploited. Finding and fixing them before attackers do is the heart of proactive defense, and it is a daily job for security teams.

Key terms

  • Vulnerability: a flaw in software, configuration or process.
  • Threat: something that could exploit it.
  • Exploit: a method of taking advantage of it.
  • Risk: the likelihood and impact of exploitation.
  • Patch: a vendor fix.
  • Zero-day: a flaw exploited before a fix exists.

CVE, CWE and CVSS

  • CVE (Common Vulnerabilities and Exposures): a unique ID for a publicly known flaw, such as CVE-2021-44228. It lets everyone talk about the same issue.
  • NVD (National Vulnerability Database): adds descriptions, scores and affected versions.
  • CWE (Common Weakness Enumeration): classifies the type of flaw, such as buffer overflow or improper input validation.
  • CVSS: a 0.0 to 10.0 severity score: None, Low (0.1-3.9), Medium (4.0-6.9), High (7.0-8.9), Critical (9.0-10.0). It considers how easy the attack is, whether privileges or user action are needed, and the effect on confidentiality, integrity and availability.

CVSS alone is not enough. Also weigh: is the system internet-facing, does it hold sensitive data, and is the flaw being actively exploited (check CISA’s Known Exploited Vulnerabilities list)?

Scanning

A vulnerability scanner compares what it finds (software versions, open ports, settings) against a database of known issues. Tools include OpenVAS/Greenbone and Nessus; Nmap can identify services. Scan types: network vs host, authenticated (logs in; more accurate) vs unauthenticated, and compliance scans against a benchmark.

Authorization is mandatory. Only scan systems you own or have written permission to test. Scans can disrupt fragile devices, so use schedules and scoping.

From findings to fixes

  1. Discover assets, since you cannot protect what you do not know about.
  2. Scan on a regular schedule.
  3. Triage: remove false positives and rank by real risk.
  4. Remediate: patch, reconfigure, or apply a compensating control such as a firewall rule.
  5. Verify with a rescan and track metrics like time to fix.

Example reading of a finding: “Outdated web server version, CVSS 9.8, internet-facing, active exploitation known” belongs at the top of the queue, while a medium finding on an isolated test machine can wait.

Check your understanding

1. What does a CVE identifier represent?

  • A password
  • A unique ID for a publicly known vulnerability
  • A virus name
  • A firewall rule

Answer: A unique ID for a publicly known vulnerability. It gives everyone a common reference.

2. A CVSS score of 9.5 is rated:

  • Low
  • Medium
  • High
  • Critical

Answer: Critical. Scores from 9.0 to 10.0 are Critical.

3. Why are authenticated scans often better?

  • They are illegal
  • They log in and see installed software and settings more accurately
  • They need no permission
  • They skip reporting

Answer: They log in and see installed software and settings more accurately. This reduces false results.

4. What is the final step of the vulnerability management cycle?

  • Ignore the finding
  • Verify the fix with a rescan
  • Delete the scanner
  • Publish the exploit

Answer: Verify the fix with a rescan. It confirms the weakness is truly closed.

PreviousNext