Running a vulnerability management programme: inventory, SLAs, exceptions, metrics
You move from one-off scans to a continuous programme, designing the asset inventory, ownership, remediation deadlines, exceptions and the metrics reported to management.
Level 401 · 12 lessons · 15 practice labs
Lessons
Foundations
- Asset inventory: the foundation of vulnerability management
- Ownership model: every finding has an owner
- Scanning coverage and blind spots
- Short task: find systems in the inventory that are never scanned
Operations
- Writing a remediation deadline policy
- Exception workflow: request, approval, expiry
- Metrics: mean time to remediate, backlog, SLA compliance
- Reporting to management and trend charts
- Short task: calculate SLA compliance from six months of data
Maturity
- Programme maturity and an improvement roadmap
- Bringing pentest and bug bounty findings into the programme
- Capstone: design an organisation’s vulnerability management programme from scratch
Practice labs
- Find systems in the inventory that are never scanned: Compare the asset list with scan targets and list those left out of coverage.
- Assign ownerless findings to the right team: Match findings with the asset ownership table and propose a rule for servers left without an owner.
- Surface shadow systems that are scanned but not in the inventory: Compare network discovery results with the inventory and report unregistered servers with their risks.
- Calculate the mean time to remediate: Calculate the average time per severity level from finding open and close dates.
- Calculate SLA compliance per team: Derive the share of findings closed on time per team from six months of data and show the one furthest behind.
- Find the misleading metric and replace it: Prove with data why the count of closed findings does not show improvement and propose the backlog trend instead.
- Prepare a one-page trend report for management: Choose three metrics, interpret the trend and end with one request for a decision.
- Write a remediation deadline policy by severity and exposure: Set deadlines for critical, high, medium and low findings on internet-facing and internal systems.
- Re-assess expired exceptions: Find the expired exception records and justify a renew, close or escalate decision for each.
- Bring pentest findings into the programme: Match report findings with existing records, merge duplicates and assign owner and deadline to the new ones.
- Tabulate open and closed findings by severity: Calculate the open, closed and overdue counts for each severity from a findings export.
- Calculate mean time to remediate per team: Derive the mean and median remediation time per team from three months of findings and explain why the two differ.
- Work out a finding’s due date from the policy: Use the given policy table to write the due date for five findings based on severity and exposure.
- Map pentest report findings to the programme’s fields: Fill in asset, severity, owner and due date for five findings.
- Deduplicate pentest findings against scanner findings: Compare the report’s findings with existing records, merge those showing the same flaw and flag the ones only found by hand.
About this course
You move from one-off scans to a continuous programme, designing the asset inventory, ownership, remediation deadlines, exceptions and the metrics reported to management.
What you will learn
- Foundations
- Operations
- Maturity
Prerequisites
You should have practised the topics of the same path up to level 301.
Lab environment
Lessons run in your own Kali Linux terminal that opens in the browser. Nothing to install; the lab starts clean in every lesson.
Frequently asked questions
- Is this course right for my level?
- The course is at level 401; it assumes you know the topics of the lower-level courses.
- Is there anything to install?
- No. Every lesson runs in your own lab environment that opens in the browser.
- How do lessons work?
- Each lesson has 8 to 10 steps and a short quiz. Early steps show the command to type, later steps give less help; if two attempts fail, the solution opens.
- Can I try it for free?
- Yes. The first three lessons of every course are free.