SSCP Systems Security Certified PractitionerRisk Identification, Monitoring, and AnalysisMedium
A security auditor is reviewing an organization's vulnerability management program. The auditor finds that while vulnerabilities are identified regularly through scanning, there is no formal process for prioritizing remediation efforts based on asset criticality, exploitability, or potential impact. Instead, vulnerabilities are patched on a 'first-come, first-served' basis. What is the most significant deficiency in this program?
- AIneffective vulnerability prioritization
- BAbsence of a defined risk acceptance policy
- CInsufficient budget for patching activities
- DLack of regular vulnerability scanning
Show answer & explanationAnswer & explanation
Correct answer: A. Ineffective vulnerability prioritization
The scenario clearly states that vulnerabilities are identified (through scanning) but that there is 'no formal process for prioritizing remediation efforts based on asset criticality, exploitability, or potential impact.' Patching on a 'first-come, first-served' basis without considering risk factors leads to inefficient and potentially dangerous remediation, making ineffective prioritization the most significant deficiency.
Why the other options are wrong
- B. While a risk acceptance policy is important, the immediate problem described is how to manage identified vulnerabilities, not whether to accept them.
- C. The scenario does not mention budget constraints as the reason for the lack of prioritization, but rather the absence of a process.
- D. The scenario states vulnerabilities are identified regularly, so this is not the deficiency.
Vulnerability Prioritization
The process of ranking identified vulnerabilities based on their severity, exploitability, asset criticality, and potential impact to guide remediation efforts.
- Essential for efficient and effective vulnerability management.
- Considers CVSS scores, threat intelligence, and business context.
- Helps allocate limited resources to the most critical risks first.
Memory trick: Identify, Assess, Prioritize, Remediate, Verify, Monitor.