5.1Security management concepts

Security operations is not only dramatic incident response; the unglamorous management processes underneath it are the foundation. "We do not know what is connected," "an unapproved configuration change slipped in," "a patch has gone unapplied for months"—such management gaps hand attackers their first foothold. This section organizes the five management concepts—asset, configuration, mobile device, patch, and vulnerability—by which risk each one is meant to eliminate, so you can choose the right process for the situation.

5.1.1Asset and configuration management

• Asset management is the process of identifying, classifying, tracking, and inventorying assets such as hardware, software, and data. Because you cannot protect, patch, or monitor what you do not know you have, it is the starting point for all management. Shadow IT and end-of-life devices missing from the inventory tend to become entry points, unmonitored and unpatched.
• Configuration management defines an approved known-good state (baseline) and governs changes, preventing unauthorized changes and configuration drift while making deviations detectable. During an incident, the difference from the "normal configuration" is itself a clue to compromise, so it also serves as a forensic reference line.

5.1.2Mobile device management (MDM)

• MDM (mobile device management) centrally manages mobile endpoints such as smartphones and tablets, uniformly enforcing policies like encryption, passcodes, and app distribution. On loss or theft it limits data leakage via remote lock/remote wipe. It is the linchpin for governing devices that move in and out of the perimeter.
• For BYOD (bring your own device), the practical compromise is containerization that separates personal and corporate spaces so that only company data can be selectively wiped. Wiping personal photos along with it is hard to accept, so the design must balance control of corporate data with respect for private life.

5.1.3Patch and vulnerability management

• Patch management is the operational cycle of evaluate -> test -> deploy -> verify for vendor patches. Applying immediately without testing risks outages, while leaving patches unapplied leaves known vulnerabilities open. The principle is to weigh urgency against business impact and roll out in a planned way through a test environment.
• Vulnerability management is the broader process of continuously discovering, assessing, prioritizing, and remediating vulnerabilities via scanning. Remediation is not limited to patching; it also includes configuration changes, disabling features, and compensating controls (mitigation). The key is prioritizing by CVSS score together with asset criticality and exposure—fixing everything at once is not realistic.

Suppose in the SOC you receive a ticket that the vulnerability scanner found "a severity 9.8 (CVSS) remote code execution vulnerability on a perimeter web server." A junior reflexively says "patch every server right now," but that conflates vulnerability management with patch management and jumps ahead. First, cross-check the asset management register: is the affected host truly an internet-facing critical asset, or an internal test box? The same CVSS carries different priority depending on exposure and asset criticality. Next, consult the configuration management baseline to judge whether an interim mitigation (disabling the feature, adding a WAF rule, restricting access) can immediately shrink the attack surface. The patch itself matters, but pushing it to production untested and taking down core business is self-defeating, so you follow patch management to test in a staging environment before a planned rollout. The key is understanding that "remediate the vulnerability" does not equal "apply a patch." Remediation includes configuration changes, disabling features, and compensating controls, and the SOC analyst's job is to choose the combination that minimizes harm in that situation. And if the asset turned out to be shadow IT missing from the inventory, the root problem is an asset-management gap, and eliminating assets that are not made visible takes precedence over patching.

5.1.4Section summary

• Asset management (identify/classify/track/inventory) is the origin of all management; configuration management makes deviations detectable via an approved baseline and change control
• MDM centrally manages mobile devices with remote wipe; BYOD uses containerization to selectively wipe only company data
• Patch management (evaluate/test/deploy/verify) is one means within vulnerability management (continuous discover/assess/prioritize/remediate); prioritize by CVSS plus asset criticality/exposure