Abstract:

The aim of this study is to propose a practical vulnerability management (VM) model based on the author’s knowledge and experience, primarily applicable to large organizations with highly developed IT infrastructures. The existing knowledge about vulnerabilities and vulnerability management is not extensively covered in the academic literature and online sources do not present it in a structured manner. The goal of this study is to gather, present and substantiate best practices in VM.

The first part of this paper examines vulnerability management process through the lens of its essential components: IT asset management, patch management, configuration management, and threat intelligence. The second part focuses on the practical aspects of vulnerability management in large organizations. It presents the vulnerability management lifecycle, a process decision tree, and the principal challenges associated with implementing each stage of the process.

This study is based on an analysis of the relevant literature and the author’s professional experience. Both academic and professional sources were used, including official websites and databases made available by companies offering vulnerability scanning services. The knowledge bases of international organizations involved in researching and publishing information on vulnerabilities were also consulted.