4.1Vulnerability management

The first step in protecting a system is knowing "where the weak spots are." Finding and closing the holes yourself before an attacker finds them first—this continuous effort is vulnerability management. This section covers the flow of finding weaknesses (identify), organizing and prioritizing them (manage), and closing them with patches or configuration changes (mitigate); the difference in how you investigate—active reconnaissance vs. passive reconnaissance; and the representative technique of port scanning plus the automation that streamlines repetitive work—learned not by rote but through the lens of "which hole to close, and how."

4.1.1The vulnerability management cycle

• Identify is the stage of discovering what weaknesses the assets have. Using vulnerability scanners, port scans, and cross-checks against an asset inventory, you learn "what" is running and "in which version." You cannot protect assets you cannot see, so visibility comes first.
• Manage is the stage of recording and classifying the found vulnerabilities and prioritizing them by severity and asset importance. Since you cannot fix everything at once, you plan to address the highest-impact ones first. Scores such as CVSS help guide prioritization.
• Mitigate is the stage of actually closing the holes—reducing weaknesses through patching, configuration changes, disabling unneeded services, and applying workarounds. After closing, you re-scan to confirm resolution. Crucially, vulnerability management is not a one-time task but a continuously repeating cycle.

4.1.2Active vs. passive reconnaissance, port scanning, and automation

• Active reconnaissance investigates by sending packets directly to the target and learning from the responses. Port scanning and querying services are typical; it is accurate but leaves traces in the target's logs and is more easily detected.
• Passive reconnaissance gathers information without touching the target, using only public information and observation of traffic—WHOIS, public web pages, search results, and the like. It leaves no traces, but the information obtained is limited.
• Port scanning is an active technique that lists which ports are open and what services run (nmap is the classic tool). Automation hands repetitive work—scanning and cross-checking—to tools and scripts so a wide scope can be inspected regularly and comprehensively. It sustains a scale that manual effort alone cannot keep up with.

Suppose you are told to find the weaknesses in a set of servers newly assigned to you. Rather than patching haphazardly, the right approach is to think along the vulnerability management cycle. In the first stage, identify, you run a port scan against the target servers (e.g., listing open ports with nmap) to learn what services run and in which versions. This "send packets directly and watch the responses" method is active reconnaissance—accurate, but because it shows up in the target's logs, in production it requires prior approval and scheduling. If you want to do groundwork before approval, limit yourself to passive reconnaissance using only public information (reading announcements or documentation of externally exposed services). In the next stage, manage, you do not merely list the vulnerabilities but prioritize them by severity score and by asset importance such as "is this server used for payments." Finally, in mitigate, you apply patches or configuration changes and re-scan to confirm the hole is truly closed. The key point: vulnerability management is not "scan once and done"—since new vulnerabilities are disclosed daily, the posture is to keep the identify -> manage -> mitigate cycle running continuously. Moreover, once the target grows to hundreds of machines, manual effort cannot keep up, so automating scans and cross-checks to enable regular, comprehensive inspection becomes the realistic defense.

4.1.3Section summary

• Vulnerability management is a continuous cycle of identify -> manage -> mitigate; after closing a hole, re-scan to confirm
• Active reconnaissance sends packets directly and is detectable; passive reconnaissance observes public information and leaves no traces
• Port scanning (nmap) is an active technique; automation sustains regular, comprehensive inspection at scale