Operation: Vulnerability Response Process
They say, "There is no software without a weak point."
In other words, computers and communication devices with countless software built in are "full of dangerous weak points". There are also business systems that manage sales and salaries...
"Vulnerability Response" by IT department is, in simple words, "repair work of software".
Specifically, the IT department collects vulnerability information from "IT information site" or "Google Alert email" on a daily basis. If information relates with the software used by the company's computer, they conduct "patch application" or "version upgrade", etc. Although there are many software perform "automatic patch" and "automatic update" by themselves recently, there are still not a few "incidents that must be handled manually".
Incidentally, once or twice a year, a security test ("vulnerability assessment") by a specialized contractor should be carried out to check whether the repair work is done properly.
Challenge: Response depends on individual
However, a tremendous number of "attack methods" are found everyday.
"Methods of attack" on old software are also reported almost every day. Even though "weak points" should have been overcome by daily repair, it seems that attackers are also improving their ideas and power, day by day. It seems to continue forever. "Vulnerabilities" announced by CVE, for example, are count to more than 10,000 annually.
(CVE:Common Vulnerabilities and Exposures)
It is no longer the amount that IT department can check through. The reality is, that experienced employees are responding using their "individual information network" and "smell?"
Hmm, wouldn't be there any way to deal it more systematically?
To put it more, I would like to record and share precisely about who decided what kind of judgment on urgent vulnerability. For example, I would like to look back on when and how the correspondence was made against sensational vulnerabilities such as "ShellShock" or "Heartbleed". (OpenSSL, GNU bash)
[Vulnerability Response Process]