ข่าวกรองภัยคุกคามและการจัดการช่องโหว่

New vulnerabilities appear daily. Vulnerability management is the ongoing process of discovering, prioritizing, and remediating weaknesses before attackers exploit them. It is a continuous loop, not a one-time scan.

The lifecycle has clear stages:

• Discover: find vulnerabilities via scans and feeds
• Prioritize: rank by risk
• Remediate: patch, mitigate, or accept
• Verify: confirm the fix
• Report: track metrics over time

A CVE is a unique identifier for a known vulnerability. CVSS is a 0-10 score describing severity based on factors like attack vector and impact. CVSS gives a baseline, but it is not the whole story.

CVSS bands roughly map to urgency. Use them to triage, but always combine with context.

Threat intelligence adds real-world context: Is this CVE being actively exploited? Is there public exploit code? Feeds like CISA KEV and EPSS help you focus on what attackers are actually using right now.

Severity alone is misleading. A medium-CVSS bug under active exploitation on an internet-facing system may outrank a critical bug on an isolated internal tool. Combine severity, exploitability, and asset exposure.

An SBOM lists every component and version in your software. When a new CVE drops, an SBOM lets you instantly answer: are we affected, and where?

In DevSecOps, vulnerability scanning runs automatically on every build: dependency scanning, container image scanning, and IaC scanning. Builds can fail when a new critical issue is found, shifting detection left.

Remediation is not always a patch. Your options are:

• Patch or upgrade the component
• Mitigate with a workaround or compensating control
• Accept the risk formally if impact is low

Track each decision with an owner and a deadline.

Define remediation SLAs by severity (for example, critical within days, high within weeks). Track metrics like mean time to remediate so the program improves measurably over time.

Vulnerability data and threat intel inform incident response: knowing which CVEs are exploited helps responders recognize attacks faster and patch the right systems first during an incident.

Test your understanding of vulnerability management.

You learned the vulnerability management lifecycle, how to read CVSS, and how threat intelligence and SBOMs enable risk-based prioritization. Integrating scanning into CI/CD, setting remediation SLAs, and feeding incident response close the loop in a mature DevSecOps program.