Vulnerability management
Also called patch management, vulnerability scanning
Vulnerability management is the ongoing process of finding, ranking, fixing and tracking security weaknesses in a firm's software, hardware and networks before attackers exploit them. It covers scanning, penetration testing, patching and reporting, and regulators such as NYDFS and EU supervisors under DORA set minimum requirements for financial firms.
How it works
The process starts with an accurate asset inventory, because unknown systems cannot be scanned. Automated tools scan systems regularly for known weaknesses, matched against public vulnerability databases and vendor advisories, and penetration tests probe for gaps that scanners miss. Each finding is rated by severity, whether it is being exploited in the wild, and how important the affected system is, so the riskiest gaps on critical systems are fixed first.
Fixes include applying patches, changing configurations or adding compensating controls where a patch is not yet available. Teams set deadlines for each severity level, test patches before deployment and escalate when deadlines slip. Open findings, overdue patches and repeat issues are reported to risk committees as key risk indicators. Third-party software and suppliers are covered too, since many breaches start with a weakness in a vendor's product.
The rules
Requires written vulnerability management policies, annual penetration testing, automated scans set by risk assessment, monitoring for new vulnerabilities and timely risk-based remediation.
Banks, insurers and other entities licensed by NYDFSRequires documented vulnerability and patch management procedures, automated scanning with weekly scans of assets supporting critical or important functions, risk-based prioritisation and patch deadlines with escalation.
EU financial entities in scope of DORACommon questions
What is the difference between vulnerability management and patch management?
Patch management is one part of vulnerability management. Vulnerability management covers finding and ranking all weaknesses, while patch management deals with testing and installing the software updates that fix many of them.
How often should firms scan for vulnerabilities?
It depends on the rules and the risk. DORA requires at least weekly scans of assets supporting critical or important functions, while NYDFS requires scan frequency set by the firm's risk assessment and annual penetration tests.
Who owns vulnerability management?
IT and security operations run scanning and patching. The CISO sets policy and deadlines, the second line challenges risk acceptance, and internal audit tests whether the process works.
