Patch & Vulnerability Management

Bundled into the existing Certified Information Systems Security Professional premium course — no separate purchase.

Included in this chapter:

Dimension	Accept	Mitigate	Transfer	Avoid
What you do	Live with the risk, relying on existing controls or judging impact low enough	Reduce the risk: patch/upgrade, disable the feature, or isolate via firewall/segmentation	Share consequences: cyber insurance, or shift to SaaS where the provider patches	Eliminate the attack surface: uninstall, decommission, or disable the capability
Eliminates the flaw?	No. Risk remains	Patch/upgrade fully eliminates it without losing function; other mitigations only reduce it	No. Risk moves to another party	Yes, by removing the vulnerable software entirely (and its function)
Typical trigger	Low-impact flaw, or strong compensating controls already present	The default response when a fix exists and the asset can take it	Risk is better borne by a third party or a managed provider	Software is unneeded, or no fix will ever come (end-of-life)
Main cost / caveat	Residual risk is owned and must be tracked, not forgotten	Patch may break interacting software; needs testing, a window, and a back-out	Insurance has limits/exclusions; SaaS shifts but does not erase accountability	Loss of the capability or the asset's business value

Cheat sheet

Treat patching as preventive maintenance, not firefighting
A vulnerability is a risk with four responses: accept, mitigate, transfer, avoid
Only a patch or upgrade removes the flaw without removing function
When patching can't run now, choose another response on purpose
An accurate, continuously-updated asset inventory is the foundation
Prioritize patching per asset, using business context, not per software version
Know the CVSS severity bands
Active exploitation is the sharpest prioritization signal; use the CISA KEV catalog
Test before broad rollout via phased deployment to canary assets
Every deployment needs a back-out plan
Validate a patch's authenticity and integrity before installing it
Routine patches reach production through change management
Emergency patching is expedited but still validated and documented
Verify and monitor: deployed is not the same as fixed
Unpatchable assets get compensating controls, not a pass
Plan responses in advance so a new flaw triggers a pre-approved play
Reduce how much you have to patch by shrinking the attack surface
Patch metrics must be actionable, weighing vulnerability and asset importance
CVSS has Base, Temporal, and Environmental groups. Use Environmental to localize severity to your context
Deferring or accepting a vulnerability needs a formal, time-bound risk acceptance signed by the accountable owner

Unlock with Premium — includes all practice exams and the complete study guide.

Cheat sheet