Building and Operating an Enterprise Vulnerability Management Program (VMP): A Practical Guide

Why Vulnerability Management Is Hard

More than 80% of major security incidents in Korea occur through known vulnerabilities (ones that already have patches available). When hundreds of CVEs pour in every month across thousands of assets, the core challenge is deciding what to patch and when.

The Four-Stage VMP Framework

Stage 1: Build an Asset Inventory

# Nmap으로 내부 네트워크 자산 스캔
nmap -sV -O --osscan-guess \
  -oX assets.xml \
  192.168.0.0/24

Stage 2: Vulnerability Scanning

Scanning tools:

• Free: OpenVAS/Greenbone, Nuclei
• Commercial: Tenable Nessus, Qualys VMDR, Rapid7 InsightVM

# Nuclei로 웹 앱 스캔
nuclei -u https://app.company.com \
  -t cves/ \
  -severity critical,high \
  -o results.txt

Stage 3: Risk Prioritization

CVSS alone is not enough. CVSS measures the severity of the vulnerability itself, not the risk in your environment.

def calculate_priority(cve):
    score = cve.cvss_score * 10

    # 실제 공격 코드 존재 여부 (CISA KEV 목록)
    if cve.in_cisa_kev:
        score += 50

    # 인터넷 노출 여부
    if cve.asset.internet_facing:
        score += 30

    return score  # 70 이상 시 긴급 패치

Stage 4: Patch Management SLAs

Always apply patches in this order: test environment → staging → production.

Vulnerability Management KPIs

• MTTD: Mean time from vulnerability disclosure to internal detection
• MTTP: Mean time from detection to patch completion
• Patch rate: Percentage of patches completed within the SLA window

Vulnerability management cannot be done by the security team alone. You need a process built together with development, infrastructure, and leadership for it to be sustainable.

Beyond CVSS: EPSS and KEV

If you prioritize by CVSS score alone, you will miss the vulnerabilities that are actually being exploited. Use both of these signals together.

• CISA KEV (Known Exploited Vulnerabilities): A catalog of vulnerabilities confirmed to have been used in real attacks → treat as highest priority.
• EPSS (Exploit Prediction Scoring System): Probability (0–1) that a vulnerability will be exploited in the next 30 days. Even a CVSS 9.8 can be deprioritized if its EPSS is low.

# KEV + EPSS 결합 우선순위 (보강판)
def priority(cve):
    if cve.in_cisa_kev:          # 이미 악용 중
        return "긴급"
    if cve.epss >= 0.5 and cve.asset.internet_facing:
        return "높음"
    if cve.cvss >= 9.0:
        return "중간"
    return "정상 주기 패치"

When You Cannot Patch Immediately: Compensating Controls

Many assets cannot be patched immediately due to operational-disruption risk or compatibility issues. In those cases, buy time with virtual patching.

• Block exploit traffic for the vulnerability with WAF/IPS signatures.
• Cut external exposure of the vulnerable service (access control, segmentation).
• Even after applying compensating controls, track the permanent patch schedule as a ticket.

Container and Cloud Vulnerability Management

# 이미지 빌드 단계에서 차단 (CI에 통합)
trivy image --exit-code 1 --severity CRITICAL,HIGH my-app:latest

# IaC 설정 오류 점검
trivy config ./terraform

An image is not “done” once it is built. Existing images in the registry must be rescanned whenever new CVEs are published.

Alignment with Korean Regulations

• ISMS-P: Periodic vulnerability assessments and tracking of remediation results are certification control items.
• Critical Information and Communications Infrastructure (CII): At least one vulnerability analysis and assessment per year is a legal obligation under the Act on the Protection of Information and Communications Infrastructure.
• Scanning without tracking remediation will cause problems in both certification audits and incident response.

FAQ

Q. Our scanner dumps too many findings. Where do we start? Start with the intersection of the KEV catalog and internet-facing assets. “Exploitable × exposed” is the real risk.

Q. We’re afraid a patch will break the service. That’s why you need test → staging → production stages and a rollback plan. Accumulated patch avoidance becomes the biggest risk of all.

References

• CISA KEV — Known Exploited Vulnerabilities Catalog
• FIRST EPSS — Exploit Prediction Scoring System