OWASP Vulnerability Management Guide

OWASP Vulnerability Management Guide Vulnerability management is one of the most effective means of controlling cybersecurity risk. Yet, as indicated by the wave of massive data breaches and ransomware attacks, all too often organizations are compromised over missing patches and misconfigurations. Vulnerability management seeks to help organizations identify such weaknesses in its security posture so that they can be rectified before they are exploited by attackers. The OWASP Vulnerability Management Guide project seeks to establish guidance on the best practices that organizations can use establish a vulnerability management program within their organization. The guide provides in depth coverage of the full vulnerability management lifecycle including the preparation phase, the vulnerability identification/scanning phase, the reporting phase, and remediation phase. Description The vulnerability management guide should help to breakdown vulnerability management process into a manageable repeatable cycles tailored to your organizational needs. Target audience: information security practitioners of all levels, IT professionals, and business leaders. Vulnerability Management Cycle: DETECTION REPORTING REMEDIATION Licensing The OWASP Vulnerability Management project is licensed under the Creative Commons Attribution-ShareAlike 3.0 license, so you can copy, distribute and transmit the work, and you can adapt it, and use it commercially, but all provided that you attribute the work and if you alter, transform, or build upon this work, you may distribute the resulting work only under the same or similar license to this one. Roadmap As of September 2018, the highest priorities for the next 8 months are: a “bare bones” list (coming soon); a logical diagram (coming Q4 2018); a Power Point presentation (coming Q4 2018); a DIY guide with notes that reference controls, useful sources, and examples (coming Q1 2019); a DIY guide with the notes, examples, and illustrations (coming Q1 2019). Subsequent releases will be unscheduled: Bug Fix Internationalization Getting Involved Involvement in the development and promotion of the OWASP Vulnerability Management Guide is actively encouraged! You do not have to be a security expert or a programmer to contribute. Some of the ways you can help are as follows: Spreading awareness of the project Translating into a foreign language

Project Leader Elizabeth Frenz Classifications