Vulnerability management

This article needs additional citations for verification. Please help improve this article by adding citations to reliable sources. Unsourced material may be challenged and removed. Find sources: "Vulnerability management" – news · newspapers · books · scholar · JSTOR (June 2013) (Learn how and when to remove this message)

Vulnerability management is the "cyclical practice of identifying, classifying, prioritizing, remediating, and mitigating"

Correcting vulnerabilities may variously involve the installation of a patch, a change in network security policy, reconfiguration of software, or educating users about social engineering.

Project vulnerability is the project's susceptibility to being subject to negative events, the analysis of their impact, and the project's capability to cope with negative events.^[5] Based on Systems Thinking, project systemic vulnerability management takes a holistic vision, and proposes the following process:

1. Project vulnerability identification
2. Vulnerability analysis
3. Vulnerability response planning
4. Vulnerability controlling – which includes implementation, monitoring, control, and lessons learned

Coping with negative events is done, in this model, through:

• resistance – the static aspect, referring to the capacity to withstand instantaneous damage, and
• resilience – the dynamic aspect, referring to the capacity to recover in time.

Redundancy is a specific method to increase resistance and resilience in vulnerability management.^[6]

Antifragility is a concept introduced by Nassim Nicholas Taleb to describe the capacity of systems to not only resist or recover from adverse events, but also to improve because of them. Antifragility is similar to the concept of positive complexity proposed by Stefan Morcov.