Introduction

This chapter covers the third objective of Domain 4.0 Security Operations of the CompTIA Security+ 701 exam.

In this chapter, we will review vulnerability identification methods, including application security, and consider sources of information, such as threat feeds, Open Source Intelligence (OSINT), penetration testing (pen testing), and a bug bounty, and the scoring and classification of this data, using the Common Vulnerability Scoring System (CVSS) and vulnerability classification, respectively. We will finish the chapter with an exploration of vulnerability remediation and the creation of a management report.

This chapter will give you an overview of why having an effective vulnerability management program is vital. This will enable you to answer all exam questions related to these concepts in your certification.

Note

A full breakdown of Exam Objective 4.3 will be provided at the end of the chapter.

Identification Methods

This section explores a range of cybersecurity methods, from traditional scans, such as vulnerability scans and penetration scans, to gathering threat intelligence data and monitoring the dark web, providing us with a comprehensive guide to identifying threats and vulnerabilities. This information is detailed in the following sections.

Vulnerability Scans

Scanning involves systematically probing systems and networks for vulnerabilities. Vulnerability scanning tools identify weaknesses in software, configurations, or hardware that can be exploited by cyber attackers. Regular scans are essential for maintaining a strong security posture.

There are two types of vulnerability scans, non-credentialed and credentialed. The CompTIA Security+ 701 examination requires that you have a good knowledge of each as these are usually heavily tested.

A non-credentialed scan operates with restricted privileges and can only identify vulnerabilities that are visible...

Vulnerability Response and Remediation

The main goal of this section is to discuss important strategies and tactics used to respond to vulnerabilities and address cybersecurity risks. These practices include patching, insurance, segmentation, and compensating controls, each playing a unique role in safeguarding organizations against cyber threats. All of the information is listed as follows.

Patching

One of the fundamental practices in vulnerability response is patch management. This involves regularly updating software, applications, and systems to address known vulnerabilities. Timely patching is crucial, as it bolsters an organization’s defense by closing security gaps that malicious actors may exploit. Failure to patch promptly can leave systems exposed to cyberattacks, making it an indispensable aspect of cybersecurity risk mitigation. Legacy devices present a distinct security concern because when vendors discontinue support for them, there may be no available patches...

Validation of Remediation

Validation of remediation is the process of confirming that security vulnerabilities identified in an organization’s systems, applications, or networks have been successfully addressed and mitigated. It is a crucial step in the vulnerability management life cycle, assuring stakeholders that the identified risks have been appropriately managed. Let’s look at the three stages of validation in the following sections.

Rescanning

After applying patches, fixes, or other corrective measures to address vulnerabilities, it’s imperative to conduct rescanning, as it verifies the effectiveness of remediation efforts. This involves running vulnerability assessments or scans on the affected systems or applications, verifying that the identified vulnerabilities have indeed been remediated. Rescanning helps in several ways:

• Validation of effectiveness: Rescanning confirms whether the applied remediation actions were successful in eliminating...

Reporting

The management of an organization will require a vulnerability report in order to make informed decisions regarding vulnerability management. These reports are produced by the vulnerability scanning systems and should include the following:

• Vulnerability overview: This is a summary of the current vulnerability landscape, including the total number of vulnerabilities, their severity distribution, and trends over time.
• CVSS scores: These relate detailed information on the varying levels of severity for identified vulnerabilities, and those of the highest priority that require immediate attention should be highlighted.
• Remediation progress: This is an update on the status of remediation efforts, including the number of vulnerabilities addressed and those still pending.
• Risk reduction: The report should include metrics by which to measure vulnerability management activities that have contributed to reducing the organization’s overall cybersecurity risk...

Summary

In this chapter, we covered various activities associated with vulnerability management. We covered vulnerability identification methods such as static and dynamic analysis, information gathering techniques (threat feeds, OSINT, pen testing, and a bug bounty), and vulnerability scan data analysis. This included using CVSS and effective patch management to prioritize and remediate vulnerabilities, which are then documented in a management report.

The knowledge gained in this chapter will prepare you to answer any questions relating to Exam Objective 4.3 in your CompTIA Security+ certification exam.

The next chapter of the book is Chapter 17, Explain security alerting and monitoring concepts and tools.

Exam Objective 4.3

Explain various activities associated with vulnerability management.

• Identification methods:
  • Vulnerability scan: An automated system checks for weaknesses
  • Application security: Evaluating software for potential vulnerabilities
  • Threat feed: Gathering data on emerging threats
  • Penetration testing: Simulating cyberattacks to uncover vulnerabilities
  • Dark web: Monitoring hidden online spaces for risks
  • Static analysis: Examining code for vulnerabilities without execution
  • Dynamic analysis: Evaluating software during execution for vulnerabilities
  • Package monitoring: Tracking software component vulnerabilities
  • Open-source intelligence (OSINT): Gathering public information for insights
  • ISO: Collaborative efforts to share threat data
  • Responsible disclosure program: Reporting and addressing vulnerabilities ethically
  • Bug bounty program: Rewarding individuals for finding and reporting vulnerabilities
  • System/process audit: Comprehensive review of systems and processes
• Analysis:
  • Confirmation...

Chapter Review Questions

The following questions are designed to check that you have understood the information in the chapter. For a realistic practice exam, please check the practice resources in our exclusive online study tools (refer to Chapter 29, Accessing the online practice resources for instructions to unlock them). The answers and explanations to these questions can be found via this link.

1. The board of directors of an organization is convening to decide on its vulnerability management policies. What key framework or system will help them prioritize vulnerabilities effectively?
   1. CVSS
   2. CMS
   3. CVE
   4. SEO
2. A multinational technology company is seeking to enhance its cybersecurity defenses. To achieve this, they have launched a bug bounty program, inviting security researchers, ethical hackers, and cybersecurity enthusiasts to participate. Which of the following describes the benefit and objective of a Bug Bounty?
   1. The organization intends to identify and fix security vulnerabilities...