Vulnerability Management Guide

This is an original planning guide. It is not a vendor manual, an official standard, or legal advice. Example addresses use documentation ranges. Review every command before you paste it.

A CVE is a name, not a work order by itself

A vulnerability record names a product and a problem. It becomes your work only when you run that product, at a version the record describes, on a system you administer. The CVE lookup on this site finds the record. The prioritisation calculator turns exposure and impact into an order. Neither one exploits anything.

The vendor's fix or mitigation is the change. You do not need a proof of concept to decide to patch a system you know is exposed. Hunting for exploit code is out of scope for this desk. If a record has no fix yet, the zero-day response guide is the containment, and this page is the queue.

Order the work. An exposed service on the internet comes before an internal library nobody can reach. A score is an input. Your exposure is the other input. A high score on a product you do not run is not a project.

The system desk's patch guide is the ring: lab, canary, then the rest, with a reboot when the fix does not run until reboot. This page decides what enters the ring.

One record, one owner, one system

Pick one record for software the lab actually has. Write the product, the version you observed, and whether the lab is reachable only by you. Look up the vendor fix. If the fix is a package update, it joins the patch ring. If the mitigation is a config change, it is one change with a rollback.

Write the owner and the date you will recheck. A queue with no dates is a list. The calculator's number goes in the ticket next to your exposure sentence, and the sentence wins when they disagree.

Do not paste exploit detail, sample payloads, or links to attack code into the ticket. The ticket has the record id, the version, the fix, and the ring.

When the canary is patched, record the version after. The vulnerability is not closed because the job was scheduled.

A change you can finish

The change is the vendor fix on the ring, or the vendor mitigation on one system. Discovery of a record is not itself a change to production.

Rollback is the patch guide's previous version, or the previous config, written down first.

Confirm you run the product and the version.
Read the vendor fix. Ignore exploit write-ups.
Score exposure in a sentence, then use the calculator.
Put the fix in the patch ring or apply one mitigation.
Record the version or the setting after the change.
Give the item an owner and a recheck date.
Leave the next record for its own place in the queue.

Mistakes that outlive the command

vulnerability management fails in the same few ways. Each one looks finished on the day you type it. The list is here so the ticket can forbid them before the window, not so you can recognise them in an incident review.

A high score for software you do not run.
Exploit notes in the ticket.
Patching the fleet before the canary.
Calling a scheduled job a completed fix.
A mitigation you cannot undo.
Turning off a security control so a scanner stops complaining.
Scanning networks you do not administer to build a queue.
A queue with no owner.

Decisions to write down before the window

One decision for vulnerability management: The record matches software you run. The fix is the vendor's, and exploit material is not in the ticket. Exposure is a sentence. The calculator result sits beside it. The patch ring is lab, canary, then the rest. A config mitigation has a rollback. The after-version is recorded. An owner and a recheck date exist. No scan of systems you do not administer was part of this work. A missing fix goes to the zero-day response guide instead of a search for attack code. And one record moves in this window.

The hour you stop

Write the hostname or the system name, the owner, and the clock time before you change anything for vulnerability management. If the system is serving people and you do not have a spare, this hour is a plan, not a change. A plan you can read tomorrow is a success. A change you cannot undo is not.

Use a lab or a copy. The log line you test with is one you created, or one you are already allowed to hold. You do not point a tool at a network, a mailbox, or an account you do not administer. The tools on this site run in the browser. They do not log in, and they do not scan.

prompt-for-this is a reminder that a secret is missing. It is not a password, a token, or a key you save. The real secret stays in the password store. If a draft, a log, or a ticket still contains a live secret, stop and rotate it. Then delete the copy.

One change. A firewall, a detection, a DNS record, and a policy do not share a window. If two things move and the outcome is wrong, you will not know which one did it. The rollback is the previous value, written down while the system still works.

A second person reads the scope aloud: which host, which domain, which account. If they cannot find it in the ticket, the ticket is not ready. Silence is not agreement.

Documentation addresses stay in the lab. 192.0.2.0/24, 198.51.100.0/24, and 203.0.113.0/24 are not your production network. example.com is not your domain. Replace them before a real record or a real rule is published.

Do not allow every address because a test failed. A rule, a header, or a detection that matches the world is a draft you delete. Management stays on the prefix you named. A service port opens when the service is ready, for the clients you named.

Keep the previous file. A generator draft is not the previous file. The previous file is what you reload if the new one is wrong. You practised the reload on the lab, with a console or a second session open when the change can lock you out.

If a step fails twice, stop. The failure is the result. Adding a command from a forum beside a half-applied config produces a system nobody can explain. Rebuild the lab from the copy you kept.

When the checks pass, the next system waits until someone else can repeat the proof from the notes. vulnerability management is done for this window when the proof is written, not when the tool printed a file.

This page is a planning guide. It is not legal advice, not an audit opinion, not a vendor manual, and not the text of a standard. If a lawyer, an auditor, or a regulator must see the decision, they see the ticket and the evidence, not this paragraph.

Hand the finished note to the neighbouring guide that owns the next step, and leave this system alone until that guide has its own window.

Vulnerability checks before the ring continues

Confirm this before you call the change done: The product and version were observed, not assumed. The vendor fix is named. The ticket has no exploit steps or payloads. The canary was patched before the fleet. The running version after the change matches the fix. Rollback is the previous version or setting. The owner and date are written. The calculator output is filed with the exposure sentence. You did not scan someone else's network. A control was not disabled to silence a finding. A second person read the record id and the version. The next record is still in the queue, not in this window. The hostname in the prompt matches the hostname in the ticket for vulnerability management. The result line includes the time and the person, not only the command. You can point at the rollback value without searching a chat history. And done is a sentence a second person can repeat: the proof for vulnerability management happened, and the next host is not started early. If one of those fails, stop.

Tools for this guide

These tools run in the browser on this site. They do not log into your machines.

Guides in this cluster

These supporting pages belong to this pillar.