OWASP Vulnerability Management Guide

Failures of vulnerability management programs are likely to result from failures of implementation caused by the common misconception that a working security scanner equals managing vulnerabilities in IT environments. Vulnerability management cannot be outsourced to a single tool or even a set of very good tools that would seamlessly orchestrate a process around “some findings” and “some patches”. The processes described in the guide involve decision making based on risk practices adopted by your organization. If you are tasked with rolling out a vulnerability management program – this guide will help you ask the right questions. If you are a manager or CISO, the guide should outline how a vulnerability management program can be integrated into your organization. Regardless of your role, the purpose of the OWASP Vulnerability Management Guide is to explain how continuous and complex processes can be broken down into three essential parts, which we call cycles. [To read]