top of page

Vulnerability Management Life Cycle

FlowChartVulnCycle.png

Meaning behind each step of the Vulnerability Management Life Cycle:

  1. Discover - identify and create an inventory of all assets

  2. Prioritize Assets - categorize assets by priority and secure high impact systems first

  3. Assess - ensure scans and checks are done continuously for vulnerabilities

  4. Report - create reports tailored with information depending on intended recipients use

  5. Remediate - detail a plan to secure vulnerable systems following priority and ensure documentation of each step

  6. Verify - through follow up scans check that the vulnerability / threats have been secured

CVE - Common Vulnerabilities and Exposures

CVE.png

CVE's are identifiers for openly known vulnerabilities to provide a common platform to evaluate and store a database of security issues. Thus allowing a standardize vulnerability information system and ease of communication.

​

Maintained by the MITRE Corporation who collect and catelogs using the Security Content Automation Protocol (SCAP). Which evaluates and assigns each vulnerability a unique identifier. 

CVSS - Common Vulnerability Scoring System

CVSS.png

CVSS is a way to measure the impact of the vulnerabilities which is also known as the CVE score. 

The current iteration of the CVSS is v3.1 which uses two columns (Severity and Base Score) from None to Critical and 0 to 10.0.

​

For organizations that don't use CVSS there is a NVD calculator that can be used to perform this calculation.

Sources:

bottom of page