Skip to content

Vulnerability Management Workflow#

Servers and applications have numerous vulnerabilities unless they are constantly kept up to date. In corporate server environments, in particular, frequent updates are difficult to perform due to concerns such as the cost of regression testing and ensuring operational stability.

However, high-risk vulnerabilities like Log4Shell continue to be disclosed. In recent years, as soon as vulnerability information and vendor patches are released, PoC (Proof of Concept) code is often published, making it easy for anyone to exploit them with readily available tools. In this situation, service operators must sort through and respond to high-risk and low-risk vulnerabilities on a daily basis, often with limited resources.

This document provides a concrete overview of the operational workflow for investigating, assessing, responding to, and prioritizing vulnerabilities with FutureVuls.

CSIRT Plan#

The CSIRT plan includes many features useful for triage. Specifically, it has the following features:

  • SSVC
  • Triggers & Actions

FutureVuls can automatically determine the response priority for detected vulnerabilities using the latest triage engine, "SSVC," which is also recommended by the U.S. CISA. By utilizing the automatic triage feature, you can automate the process of prioritizing responses based on risk ("vulnerability" x "threat" x "business impact") and issuing instructions to operators. This feature can accurately automate risk assessments that were previously performed manually by experts. We confidently recommend it to all companies and organizations.

For details, please refer to "Triage Settings".

Workflow in Larger Environments#

In environments using the CSIRT plan, users may have different roles and responsibilities, such as:

  • CSIRT/Administrators: Issue instructions to server operators for vulnerability response and manage the vulnerability response status across the entire organization.
  • Field Operators: Apply patches to servers for vulnerabilities they have been instructed to address and report the response status to administrators.

FutureVuls provides features that are useful for the tasks of each role. For details, please refer to "Workflow from a CSIRT/Administrator Perspective" and "Workflow from a Field Operator Perspective".

Standard Plan#

The Standard Plan does not include the automatic triage feature. However, it has features that allow for flexible prioritization by combining CVSS scores with other information.

For details, please refer to "How to Use the Standard Plan".