Threats, Vulnerabilities & Mitigations · 22% of exam
L7. Vulnerability Management: Scanning, CVSS & Patching
Course outlineLesson 7 of 20
Vulnerability management is a continuous cycle of finding, prioritizing, and remediating weaknesses before attackers exploit them. The Security+ exam tests CVSS scoring, the scanning lifecycle, and the difference between scanning and pen testing.
Vulnerability Scanning vs Penetration Testing
| Aspect | Vulnerability Scanning | Penetration Testing |
|---|---|---|
| Method | Automated, non-intrusive | Manual + automated, exploits vulnerabilities |
| Authorization | Routine, ongoing | Explicit written authorization required |
| Output | List of vulnerabilities with severity scores | Proof of exploitation, attack paths, business impact |
| Frequency | Continuous or weekly | Annually or after major changes |
CVSS (Common Vulnerability Scoring System)
CVSS provides a 0-10 numerical score for vulnerabilities based on the following base metrics: Score ranges:
- 0.0: None
- 0.1-3.9: Low
- 4.0-6.9: Medium
- 7.0-8.9: High
- 9.0-10.0: Critical
CVE and NVD
CVE (Common Vulnerabilities and Exposures): provides a unique identifier (CVE-2024-12345) for each publicly known vulnerability. NVD (National Vulnerability Database): enriches CVEs with CVSS scores, affected software lists, and remediation references. Zero-day: a vulnerability with no available patch, often because the vendor is unaware of it. Zero-days have no CVE until they are discovered and disclosed.Patch Management Lifecycle
- Inventory: know all assets and software versions
- Scan: identify vulnerabilities on the current inventory
- Prioritize: combine CVSS score with asset business criticality
- Test: deploy patch in a non-production environment first
- Deploy: roll out via SCCM, Intune, Ansible, or similar
- Verify: re-scan to confirm the vulnerability is remediated
Exam Focus Points
- ✓Vulnerability scanning is automated and non-intrusive; penetration testing actively exploits vulnerabilities and requires written authorization
- ✓CVSS base score ranges: 0-3.9 Low, 4.0-6.9 Medium, 7.0-8.9 High, 9.0-10.0 Critical
- ✓A zero-day vulnerability has no available patch; the vendor typically has had zero days to respond
- ✓CVE provides the unique identifier; NVD enriches CVEs with CVSS scores and remediation guidance
- ✓Patch prioritization must consider both CVSS score AND business criticality of the affected asset
Knowledge Check
1. Which activity requires explicit written authorization and actively exploits vulnerabilities to demonstrate impact?
2. A CVSS base score of 9.1 indicates which severity level?
3. A researcher discovers a previously unknown vulnerability in a web server with no patch available from the vendor. What is this type of vulnerability called?