Throughout my time of being the owner and handling the entire vulnerability scanning and patch management activity of the entire organization, I have learned a lot. Here are some of the important things to remember:
- CVSS is important, but don't always rely on it.
- Also CVSS is an important benchmark in determining the overall score of a vulnerability. However, placing your priority on remediation of a vulnerability depending on CVSS scores is not always ideal.
Let's understand this with an example. The Heartbleed bug is one of the serious vulnerabilities in OpenSSL implementation that is widely used in a TLS protocol. This weakness typically allows the attacker to steal information that is encrypted and protected by SSL/TLS protocols. It can even compromise the secret keys that are used during the encryption process.
Now, typically for the banking sector...
