1 of 15

Vulnerability Management

Enterprise Network 101 Workshop

2 of 15

What is a Vulnerability?

• A vulnerability is a weakness in an information system

that can be exploited by an attacker

​

• When we talk about Vulnerability Management, the primary vulnerability being addressed is an exploitable software flaw – either because a system wasn’t patched or it was a ‘zero-day’ (a vulnerability that was disclosed before a patch was made available)

3 of 15

What is Vulnerability Management?

  • Definition:� A continuous process to identify, evaluate, treat, and report on security vulnerabilities � in systems and software.�Purpose:� Reduce risk of exploitation � and maintain a secure� IT environment.

4 of 15

Why It Matters in Enterprise

  • Complex infrastructure with many endpoints and applications
  • High value targets for attackers
  • Regulatory compliance (e.g., ISO 27001, HIPAA, GDPR)
  • Reputation and operational risk if breached

5 of 15

Key Components of Vulnerability Management

  1. Asset Discovery
  2. Vulnerability Assessment
  3. Risk Prioritization
  4. Remediation & Mitigation
  5. Verification & Reporting

6 of 15

Vulnerability Management Lifecycle

  1. Discover assets
  2. Identify vulnerabilities
  3. Prioritize by risk
  4. Apply fixes or mitigations
  5. Verify resolution
  6. Continuous monitoring

7 of 15

Common Tools Used

  • Scanning Tools:

Nessus, OpenVAS, Qualys

  • Patch Management:

WSUS, SCCM, Ansible

  • SIEM & Monitoring:

Splunk, IBM QRadar, ELK Stack

8 of 15

Risk-Based Prioritization

  • Use CVSS (Common Vulnerability Scoring System)
  • Consider asset criticality and business impact
  • Focus on exploitable vulnerabilities with known threats

9 of 15

Challenges in Vulnerability Management

  • Lack of asset visibility
  • Shadow IT / unmanaged devices
  • Patch management delays
  • Poor coordination between IT & Security teams

10 of 15

Best Practices

  • Maintain accurate asset inventory
  • Schedule regular vulnerability scans
  • Integrate patching with CI/CD pipelines
  • Use automation where possible
  • Educate staff on secure practices

11 of 15

Compliance & Reporting

  • Maintain audit logs of scans and remediations
  • Align with frameworks (NIST, ISO, CIS Controls)
  • Generate regular reports for management and auditors

12 of 15

Case Study / Real-World Example

  • Equifax breach (2017)

​

    • Unpatched Apache Struts vulnerability
    • Lack of visibility and timely remediation
    • Cost: $700M+ and reputational damage

13 of 15

Equifax breach (2017)

14 of 15

Questions?

15 of 15