Why this matters
Ghanaian telco and bank adverts list vulnerability scanning, vulnerability assessment and risk based prioritisation among analyst duties. New weaknesses in common software are announced constantly, and attackers move quickly to use them. Organisations need people who can find, rank and track fixes for the systems they own.
Key words
- Vulnerability: a weakness in software, hardware or configuration.
- CVE: a public identifier for a known vulnerability, written as CVE, then the year, then a number, in the pattern
CVE-YYYY-NNNNN. - CVSS: a common scoring system from 0 to 10 describing severity. Scores are grouped as low, medium, high and critical.
- Patch: an update that fixes a vulnerability.
- Exploit: a method of taking advantage of a vulnerability.
The vulnerability management cycle
- Know your assets. You cannot protect what you do not know you have. Keep a list of computers, servers, network devices and important software.
- Find vulnerabilities. Use authorised scanning tools on systems your organisation owns, and follow vendor security notices. Scanning someone else's systems without permission is illegal.