Simple explanation
Two connected processes: finding and fixing weaknesses before they're exploited (vulnerability management), and continuously watching for signs that something's already gone wrong (monitoring and alerting).
Technical explanation
Vulnerability identification methods: vulnerability scan, application security testing, threat feed subscriptions, penetration testing, responsible disclosure programs, bug bounty programs, and system/process audits.
Vulnerability analysis: CVSS (Common Vulnerability Scoring System — a standardized 0-10 severity score), CVE (Common Vulnerabilities and Exposures — the standardized identifier for a specific known vulnerability), vulnerability classification, exposure factor (how much of an asset's value is at risk), environmental variables (does this vulnerability's real-world context make it more or less dangerous than its base score suggests), industry/organizational impact, and risk tolerance.
Response and remediation: patching, insurance (transferring residual risk), segmentation, compensating controls, exceptions/exemptions (formally accepted risk, documented), and validation of remediation (confirming the fix actually worked — don't just assume).
Monitoring resources: systems, applications, infrastructure — monitoring has to cover all three layers, not just one.
Monitoring activities: log aggregation, alerting, scanning, reporting, archiving, alert response/remediation/validation, quarantine (isolating something flagged as suspicious), and alert tuning (adjusting thresholds/rules to reduce false positives without missing real threats).
Monitoring tools: SCAP (Security Content Automation Protocol — standardized way to check configuration against security benchmarks), benchmarks (documented secure-configuration standards, like CIS Benchmarks), agent-based vs. agentless collection, SIEM (Security Information and Event Management — centralizes and correlates logs from across the environment), antivirus/antimalware, DLP (Data Loss Prevention), SNMP traps, NetFlow (network traffic metadata), and vulnerability scanners.
Synonyms / related terms
| Term | Means | |---|---| | CVE | Common Vulnerabilities and Exposures (the ID) | | CVSS | Common Vulnerability Scoring System (the score) | | SIEM | Security Information and Event Management |
Concept Check
"Two vulnerabilities share an identical CVSS base score, but one sits on an internet-facing payment server and the other on an isolated internal test system. Should they be prioritized the same?" No — CVSS base score alone doesn't account for environmental variables. The internet-facing system's real-world exposure factor and organizational impact are far higher, so it should be prioritized first despite the identical base score.
Interview-style Q&A
Q: What's the difference between a CVE and a CVSS score, and why do people confuse them? A: "A CVE is the unique identifier for a specific, known vulnerability — like a name. A CVSS score is a separate numeric severity rating, 0 to 10, describing how dangerous that vulnerability generally is. People confuse them because they're always mentioned together in a vulnerability report, but one identifies the flaw and the other rates it."
Memory trick
"Scan, Score, Fix, Watch" — the vulnerability management lifecycle in four words: identification (scan) → analysis (score via CVSS) → response/remediation (fix) → ongoing monitoring (watch, to catch what's next).