CompTIA Cybersecurity Analyst (CySA+)
2.0 Vulnerability Management
2.1 Given a scenario, implement an information security
vulnerability management process. -
CompTIA
• Identification of requirements -
As an organization begins developing a vulnerability management program, it should
first undertake the identification of any internal or external requirements for vulnerability
scanning. These requirements may come from the regulatory environment(s) in which the
organization operates and/or internal policy-driven requirements.
Vulnerability Management Programs -
They seek to identify, prioritize and remediate vulnerabilities before an attacker
exploits them to undermine the confidentiality, integrity, or availability of enterprise
information assets.
- Regulatory environments -
an environment in which an organization exists or operates that is controlled to a
significant degree by laws, rules, or regulations put in place by government (federal, state, or
local), industry groups, or other organizations. In a nutshell, it is what happens when you
have to play by someone else's rules, or else risk serious consequences. A common feature of
this is that they have enforcement groups and procedures to deal with noncompliance.
Examples include, HIPPA, ISO/IEC 27001, PCI DSS and GLBA.
Health Insurance Portability and Accountability Act of 1996 (HIPPA) -
United States law enacted in 1996 to provide data privacy and security provisions for
safeguarding medical information. It does not specifically require that an organization
conduct vulnerability scanning. It establishes penalties (ranging from $100 to 1.5 million) for
covered entities that fail to safeguard phi.
Gramm-Leach-Bliley Act (GLBA) -
A law that requires banks and financial institutions to alert customers of their policies
and practices in disclosing customer information. It does not specifically require that an
organization conduct vulnerability scanning.
PCI DSS (Payment Card Industry Data Security Standard) -
A global standard for protecting stored, processed, or transmitted payment card
information.
ISO/IEC 27001 (The International Organization for Standardization/International
Electrotechnical Commission) -
Specifies requirements for establishing, implementing, operating, monitoring,
reviewing, maintaining and improving a documented information security management
system. It is is arguably the most popular voluntary security standard in the world and covers
every important aspect of developing and maintaining good information security.
1 | P a g e
