* [Topics](/en/topics "Topics") * [Security](/en/topics/security "Security") * What is vulnerability management? What is vulnerability management? ================================= Published May 5, 2023•*5*-minute read Copy URL Jump to section --------------- OverviewFunctions of vulnerability managementIdentifying and tracking vulnerabilitiesCVSS scoresRisk-based vulnerability managementVulnerability assessments vs. vulnerability managementHow Red Hat can help Overview -------- Vulnerability management is an IT security practice that involves identifying, assessing, and remediating security flaws in devices, networks, and applications, in order to reduce the risks of cyberattacks and security breaches. Security professionals view vulnerability management as an important part of [security automation](/en/topics/automation/what-is-security-automation). It’s a necessary capability of Information Security Continuous Monitoring (ISCM), as [defined](https://nvlpubs.nist.gov/nistpubs/ir/2017/NIST.IR.8011-1.pdf) by the U.S. National Institute of Sciences and Technology (NIST). Vulnerabilities are tracked as [Common Vulnerabilities and Exposures (CVEs)](/en/topics/security/what-is-cve), a system used by the security industry to catalog flaws identified by security researchers and IT vendors. Because new CVEs arise all the time, vulnerability management is an ongoing process. A vulnerability management program helps security teams automate their detection and remediation processes, including vulnerability scanning and patching. What are the functions of vulnerability management? --------------------------------------------------- Vulnerability management aims to reduce the risk of cyberattacks and protect IT infrastructure. These processes can help reduce an organization’s attack surface by identifying and removing exploitable security issues or misconfigurations, maintaining software patches, and detecting and mitigating attacks due to an exploited vulnerability. It can help ensure everything from endpoint devices to servers to networks to cloud assets are properly patched and configured. Vulnerability management can be thought of as [five overlapping workflows](https://www.ibm.com/topics/vulnerability-management): * **Discovery:** Check an organization’s IT assets for known and potential vulnerabilities. * **Categorization and prioritization:** Categorize identified vulnerabilities and prioritize them by level of criticality and actual risk (i.e., a highly critical device vulnerability that can only be exploited when connected to the internet poses no risk if that device will never be connected to the internet.) * **Resolution:** Resolve vulnerabilities through remediation (fully addressing the vulnerability), mitigation (make it difficult to exploit or lessen its impact), or acceptance (choosing leave unaddressed vulnerabilities with low risk scores). * **Reassessment:** Conduct new assessments to ensure previous efforts worked and did not introduce any new vulnerabilities. * **Reporting:** Establish baseline metrics for vulnerability management and monitor performance over time. As a component of information security, vulnerability management supports the same functions. Under the [cybersecurity framework](https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf) established by NIST, these functions include: * **Identify:** Understand systems, people, assets, data, and capabilities. * **Protect:** Be able to limit or contain the impact of a potential cybersecurity event. * **Detect:** Enable timely discovery of cybersecurity events. * **Respond:** Take appropriate action when a cybersecurity incident is detected. * **Recover:** Plan for resilience and to restore any capabilities or services that were impaired by an incident. Red Hat resources ----------------- [Keep reading](/en/resources "Keep reading") How are security vulnerabilities identified and tracked? -------------------------------------------------------- IT security vulnerabilities are cataloged and tracked by the [CVE List](https://cve.mitre.org/cve/), an industry resource overseen by the [MITRE corporation](https://cve.mitre.org/) with funding from the Cybersecurity and Infrastructure Security Agency (CISA), part of the U.S. Department of Homeland Security. Security flaws that become CVE entries can be submitted by researchers, vendors, and members of the open source community. In addition to brief CVE entries, security professionals can find technical details about vulnerabilities from the [U.S. National Vulnerability Database (NVD)](https://nvd.nist.gov/), the [CERT/CC Vulnerability Notes Database](https://www.kb.cert.org/vuls/), and other sources such as product-specific lists maintained by vendors. Across these different systems, CVE IDs give users a reliable way to recognize unique vulnerabilities and coordinate the development of security tools and solutions. [Read more about CVEs](/en/topics/security/what-is-cve) What is a CVSS score? How and why are scores assigned? ------------------------------------------------------ The [Common Vulnerability Scoring System (CVSS)](https://www.first.org/cvss/user-guide) is an industry standard for scoring CVEs. It applies a formula that weighs a series of factors related to the vulnerability, such as whether the potential attack can be conducted remotely, the complexity of the attack, and whether it requires a user to take action. The CVSS assigns each CVE a base score ranging from 0 (no impact) to 10 (highest base impact). This score alone is not a comprehensive assessment of risk. Two other kinds of reviews—temporal and environmental—can help form a more complete CVSS analysis. A temporal review adds details around current exploitation techniques, the existence of attacks leveraging the vulnerability, or the availability of patches or workarounds for the defect. An environmental review adds organizational-specific details about mission-critical data, systems or controls that might exist in the end-consumer’s environment that could alter the impact or probability of an attack being successfully executed. Vendors and researchers can use other scales in addition to CVSS scores. For example, Red Hat Product Security uses a [four-point severity scale](https://access.redhat.com/security/updates/classification/) to help users evaluate security issues. Those ratings are: * **Critical impact:** Flaws that could be easily exploited by a remote unauthenticated attacker and lead to system compromise without requiring user interaction. * **Important impact:** Flaws that can easily compromise the confidentiality, integrity or availability of resources. * **Moderate impact:** Flaws that may be more difficult to exploit but could still lead to some compromise of the confidentiality, integrity or availability of resources under certain circumstances. * **Low impact:** All other issues that may have a security impact, including ones believed to require unlikely circumstances to be able to be exploited, or where a successful exploit would give minimal consequences. What is risk-based vulnerability management (RBVM)? --------------------------------------------------- As the number of vulnerabilities grows, and businesses assign more people and resources to security efforts, it becomes important to prioritize the work optimally. Using broad and inaccurate risk data as part of a vulnerability management program could lead to over- or under-prioritizing certain vulnerabilities, increasing the risk of a critical issue going unaddressed for too long. Risk-based vulnerability management (RBVM) is a newer approach that seeks to prioritize actions based on the threat risk to a specific organization. RBVM considers stakeholder-specific vulnerability data, including threat intelligence, the likelihood of exploitation, and the business importance of the affected assets. It can include artificial intelligence and machine learning capabilities to develop more accurate risk scores. RBVM also aims to monitor vulnerabilities in real-time, with automated continuous vulnerability scanning. What’s the difference between a vulnerability assessment and vulnerability management? -------------------------------------------------------------------------------------- A [vulnerability assessment](https://csrc.nist.gov/glossary/term/vulnerability_assessment) is an examination of an IT system’s security measures to identify security deficiencies. This can include gathering data about a system and its resources, a check for known vulnerabilities, and reporting that classifies the findings by brisk and identifies methods for improvement. You can think of a vulnerability assessment like an internal audit and scan of all infrastructure to check for security problems. Though it might be scheduled as part of a regular process, a vulnerability assessment is essentially a single event that ends with a conclusion—a report that represents a snapshot in time. Contrast this with vulnerability management, which is an ongoing effort that is automated and runs continuously. The functions of vulnerability management are ongoing, overlapping, and continuous. In this way, responses to address critical vulnerabilities can happen early and quickly, thereby improving security. [Take the hybrid cloud security preparedness assessment](/en/engage/hybrid-cloud-security-assessment "Five-minute hybrid cloud security assessment") How Red Hat can help -------------------- As a leader in open source software, Red Hat prioritizes transparency and accountability for customers and communities. Red Hat communicates about vulnerabilities frequently, and in 2022 became a [Root organization](/en/blog/red-hat-extends-common-vulnerabilities-and-exposure-program-expertise-newly-minted-root-organization) within the CVE program. Red Hat also equips organizations to more securely build, deploy, and run cloud-native applications. [Red Hat® Advanced Cluster Security for Kubernetes](/en/technologies/cloud-computing/openshift/advanced-cluster-security-kubernetes) can help you better detect and manage vulnerabilities in Kubernetes environments. [Read Red Hat's approach to vulnerability management](https://access.redhat.com/security/vulnerability-management) [Red Hat Ansible® Automation Platform](/en/technologies/management/ansible) can help your enterprise automate security responses to rapidly identify and address vulnerabilities, before they become urgent issues. Red Hat and our partners also maintain [Red Hat Ansible Certified Content Collections](/en/technologies/management/ansible/content-collections)—pre-built, supported automation content that you can apply to your security operations center. [Learn more about Ansible Automation Platform security](/en/technologies/management/ansible/gain-security-with-red-hat-ansible-automation-platform) The official Red Hat blog ------------------------- Get the latest information about our ecosystem of customers, partners, and communities. [Keep reading](/en/blog "The official Red Hat blog") Recommended for you Securing Kubernetes Clusters with Red Hat Advanced Cluster Security ------------------------------------------------------------------- Customers want to learn how Red Hat Advanced Cluster Security for Kubernetes (RHACS) can help them solve their security challenges. However, their security teams might lack experience with Kubernetes and OpenShift, and so they have challenges with implementation. [View course](https://www.redhat.com/en/services/training/do430-securing-kubernetes-clusters-red-hat-advanced-cluster-security?percmp=RHCTG0250000455236) Keep reading ------------ ### What is security automation? Security automation uses technology to perform tasks with reduced human assistance to integrate security processes, applications, and infrastructure. [Read the article](/en/topics/automation/what-is-security-automation "article | what is security automation") ### What is SOAR? SOAR refers to 3 key software capabilities that security teams use: case and workflow management, task automation, and a centralized means of accessing, querying, and sharing threat intelligence. [Read the article](/en/topics/security/what-is-soar "article | what is soar") ### What's an insider threat? An insider threat is leaked or misused data that—whether released accidentally or purposefully—could be used in malicious ways or viewed by individuals who shouldn’t have legitimate access. [Read the article](/en/topics/security/what-are-insider-threats "article | What's an insider threat") Security resources ------------------ ### Related content * Blog post [MCP security: Implementing robust authentication and authorization](/en/blog/mcp-security-implementing-robust-authentication-and-authorization) * Case study [Powering O2’s next-generation 5G network with Red Hat OpenShift](/en/resources/o2-czech-republic-case-study) * Blog post [AI trust through open collaboration: A new chapter for responsible innovation](/en/blog/ai-trust-through-open-collaboration-new-chapter-responsible-innovation) * Blog post [The nervous system gets a soul: why sovereign cloud is telco’s real second act](/en/blog/nervous-system-gets-soul-why-sovereign-cloud-telcos-real-second-act) ### Related articles * [What is patch management?](/en/topics/management/what-patch-management-and-automation) * [What is security automation?](/en/topics/automation/what-is-security-automation) * [What is AI security?](/en/topics/ai/what-is-ai-security) * [What is SOAR?](/en/topics/security/what-is-soar) * [What's an insider threat?](/en/topics/security/what-are-insider-threats) * [What is post-quantum cryptography?](/en/topics/security/post-quantum-cryptography) * [What is software supply chain security?](/en/topics/security/what-is-software-supply-chain-security) * [What is lightweight directory access protocol (LDAP) authentication?](/en/topics/security/what-is-ldap-authentication) * [What is secrets management?](/en/topics/devops/what-is-secrets-management) * [What is confidential computing?](/en/topics/security/what-is-confidential-computing) * [What are SPIFFE and SPIRE?](/en/topics/security/spiffe-and-spire) * [Red Hat Enterprise Linux security](/en/technologies/linux-platforms/enterprise-linux/security) * [What is zero trust?](/en/topics/security/what-is-zero-trust) * [Functional safety and continuous certification on Linux](/en/topics/open-source/functional-safety-and-continuous-certification-on-linux) * [What is access control?](/en/topics/security/what-is-access-control) * [What is a CVE?](/en/topics/security/what-is-cve) * [What is role-based access control (RBAC)?](/en/topics/security/what-is-role-based-access-control) * [What is kubernetes security?](/en/topics/containers/kubernetes-security) * [Shift left vs. shift right](/en/topics/devops/shift-left-vs-shift-right) * [Red Hat Lightspeed data and application security](/en/topics/management/data-application-security) * [What is CI/CD security?](/en/topics/security/what-is-cicd-security) * [What is an intrusion detection and prevention system (IDPS)?](/en/topics/security/what-is-an-IDPS) * [What is security information and event management (SIEM)?](/en/topics/security/what-is-SIEM) * [The increasing importance of cybersecurity in banking](/en/topics/financial-services/increasing-importance-cybersecurity-banking) * [Gain security with Red Hat Ansible Automation Platform](/en/technologies/management/ansible/gain-security-with-red-hat-ansible-automation-platform) * [What is edge security?](/en/topics/security/what-is-edge-security) * [What is the importance of operational resilience?](/en/topics/financial-services/what-is-operational-resilience) * [What is backup and recovery?](/en/topics/security/backup-and-recovery) * [What is container security?](/en/topics/security/container-security) * [What is DevSecOps?](/en/topics/devops/what-is-devsecops) * [What is compliance management?](/en/topics/management/what-is-compliance-management) * [Why choose Red Hat for DevSecOps](/en/topics/devops/why-choose-red-hat-for-devsecops) * [What is cloud governance?](/en/topics/automation/what-is-cloud-governance) * [Security in the software development lifecycle](/en/topics/security/software-development-lifecycle-security) * [Kubernetes security best practices](/en/topics/containers/kubernetes-security-best-practices) * [Security for IoT devices](/en/topics/security/security-for-iot-devices) * [What is identity and access management (IAM)?](/en/topics/security/what-identity-and-access-management-iam) * [Advantages of Kubernetes-native security](/en/topics/containers/advantages-of-kubernetes-native-security) * [Intro to Kubernetes security](/en/topics/containers/intro-kubernetes-security) * [Container and Kubernetes compliance considerations](/en/topics/containers/compliance) * [What is risk management?](/en/topics/management/what-is-risk-management) * [What is SELinux?](/en/topics/linux/what-is-selinux) * [Hybrid cloud security](/en/topics/security/what-is-hybrid-cloud-security) * [What is financial services security (and compliance)?](/en/topics/security/security-and-compliance-financial-services) * [What is API security?](/en/topics/security/api-security) * [What is malware?](/en/topics/security/what-is-malware) * [What is cloud security](/en/topics/security/cloud-security) [More about this topic](/en/topics/security "More about this topic")