DJames617 
Vulnerability assessment
Vulnerability management works through a formal process called vulnerability assessment and ties directly into risk management. Asset criticality matters because not every system fails with the same blast radius.
Notes
Study material that needed a place to live.
Present me looking out for future me. Future me loses handwritten notes.
Scanner outcomes
- False positive: scanner finds a vulnerability that does not exist.
- True positive: scanner correctly identifies a vulnerability.
- False negative: scanner misses a vulnerability that exists.
- True negative: scanner correctly determines a vulnerability does not exist.
Patch lifecycle
- Determine priority and schedule deployment.
- Test the patches.
- Ensure the patches work properly.
- Deploy to the live environment.
Risk handling
- Transfer: pass the risk to a third party.
- Mitigate: reduce risk to an acceptable level.
- Avoid: terminate the risky activity or choose another path.
- Accept: understand the risk and live with it intentionally.