Chapter 21 — Vulnerability management
Lesson map
Lesson 21 published. Map, example, EX061.
flowchart TD
N0["Learning outcomes"]
N1["21.1 The cycle"]
N2["21.2 The vulnerability lab"]
N3["Lab — Overdue vulnerability findings against remedia"]
N4["21.3 Prioritising"]
N5["21.4 Causes of delay"]
N0 --> N1 --> N2 --> N3 --> N4 --> N5
N5 --> EX["Worked example"]
EX --> Q["Exercise EX061"]
Logical drawing
flowchart LR
N0["Learning outcomes"]
N1["21.1 The cycle"]
N2["21.2 The vulnerability lab"]
N3["Lab — Overdue vulnerability findings against remedia"]
N4["21.3 Prioritising"]
N5["21.4 Causes of delay"]
N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> Q["EX061"]
[Learning outcomes]
|
v
[21.1 The cycle]
|
v
[21.2 The vulnerability lab]
|
v
[Lab — Overdue vulnerability findings against remedia]
|
v
[21.3 Prioritising]
|
v
[21.4 Causes of delay]
|
v
[Worked example] --> [Exercise EX061]
Learning outcomes
You will (1) describe the vulnerability management cycle; (2) measure findings against remediation targets; (3) prioritise fixes by severity and exposure.
21.1 The cycle
In her third year, Aisha studies vulnerability management: finding weaknesses, assessing them, fixing them and checking the fixes. Ashfield runs a monthly scan of its computers and servers, which produces a list of findings with severity ratings. Its standard sets remediation targets: critical findings within fourteen days, high within thirty and medium within ninety. Dr. Carrow explains that scanning without fixing achieves nothing, so the cycle must be measured at the fixing stage, not only at the finding stage. Aisha reviews the latest scan.
21.2 The vulnerability lab
The lab builds a synthetic list of 400 open findings with severity and age in days. Of 29 critical findings, five are older than fourteen days, 17.2 percent. Of 103 high findings, 27 are overdue against thirty days, 26.2 percent. Of 268 medium findings, 57 are overdue against ninety days, 21.3 percent. Overall, 89 of 400 findings are overdue. Aisha notes that the five overdue critical findings deserve attention first, even though high findings have the largest overdue share. She shows the IT manager a table of overdue findings by severity, with the five critical items listed by system and age, so he can assign them to staff the same day.
Lab — Overdue vulnerability findings against remediation targets
"""Find vulnerability findings overdue against remediation targets (stdlib only)."""
import random
from collections import Counter
random.seed(21)
target = {"critical": 14, "high": 30, "medium": 90}
finds = []
for _ in range(400):
sev = random.choices(["critical", "high", "medium"], [1, 4, 10])[0]
finds.append((sev, int(random.expovariate(1 / (target[sev] * 0.7)))))
total = Counter(s for s, _ in finds)
over = Counter(s for s, a in finds if a > target[s])
for s in target:
print(f"{s}: {total[s]} open, {over[s]} overdue ({over[s]/total[s]:.1%}) against {target[s]} days")
print(f"all: {len(finds)} open, {sum(over.values())} overdue")
Run with python3 lab_vulns.py. Verified output:
critical: 29 open, 5 overdue (17.2%) against 14 days
high: 103 open, 27 overdue (26.2%) against 30 days
medium: 268 open, 57 overdue (21.3%) against 90 days
all: 400 open, 89 overdue
21.3 Prioritising
Severity alone is not enough. Aisha adds exposure: whether the system is reachable from the internet and whether the vulnerability is known to be exploited in real attacks. Two of the five overdue critical findings are on the online banking server, which faces the internet, so they come first. The others are on internal systems. She learns that combining severity, exposure and evidence of real-world exploitation gives a better order of work than severity ratings alone. She records the order and her reasons in a short note for the IT manager.
21.4 Causes of delay
Aisha asks why findings become overdue. Some need a supplier update not yet released; some require downtime that branches resist; some were simply forgotten. For supplier delays, she recommends temporary measures such as restricting access to the affected service. For downtime, she proposes a monthly maintenance window agreed with branch managers. For forgotten items, she suggests a weekly overdue list sent to each owner. Dr. Carrow notes that each cause needs its own remedy. Branch managers accept the maintenance window after seeing the overdue critical findings.
Worked example
Aisha measures 400 synthetic findings against targets, finds 89 overdue including 5 critical, prioritises internet-facing systems and addresses causes of delay.
Synthetic case. Findings are synthetic; outputs come from lab_vulns.py.
Errors and limits
Prioritising by severity alone ignores exposure and active exploitation.
Exercises
- EX061 — Overdue critical. How many critical findings are overdue? Rubric: 3 = five, 17.2 percent;; 2 = partly correct;; 1 = wrong;; 0 = none.
- EX062 — Overdue high. What share of high findings is overdue? Rubric: 3 = 26.2 percent;; 2 = partly correct;; 1 = wrong;; 0 = none.
- EX063 — Total overdue. How many findings are overdue overall? Rubric: 3 = 89 of 400;; 2 = partly correct;; 1 = wrong;; 0 = none.
Continue studying — lesson 21 (chapter 21 of 40)
← Chapter 20 · Course chapter index · Chapter 22 →
Continue to the next authored lesson.