Security Ops: Vulnerability Assessments and Operational Risk

This chapter discusses vulnerability management and operational risk. The Center for Internet Security is a community‐driven nonprofit globally recognized for their controls and guidelines that proactively safeguard an enterprise. A vulnerability is a weakness in a system design, in the implementation of an operational procedure, or in how software or code was developed (for example, coding errors, backdoors not removed in production, or vulnerabilities in code). Vulnerabilities may be eliminated or reduced by the correct implementation of safeguards and compensating countermeasures. Enterprise organizations have many options in the tools used to troubleshoot networks, identify assets, and regularly assess for vulnerabilities. Often in cybersecurity, senior management aspires to reduce their vulnerability management score to zero for the entire enterprise. They want sysadmins to patch everything and engineers to place compensating controls in every location as well as tasking DevSecOps to upgrade all of the software.