3.6. Reflection Checkpoint

Key Takeaways

• Asset discovery is the prerequisite — You cannot scan or protect unknown assets. Continuous discovery of internet-facing infrastructure is essential.
• Scan type must match the target — Credentialed scans find more but require careful credential management. Passive scans are safe for OT but miss many vulnerabilities. Match the approach to the risk tolerance of the target system.
• CVSS score ≠ remediation priority — Context transforms severity into risk. Add: is it internet-facing? Is there a public exploit? Is the asset critical? Is it on the CISA KEV list?
• False positives waste resources — Validate scanner findings before committing remediation effort. Tune scanners to reduce noise; analyst time spent on false positives is time not spent on real vulnerabilities.
• Injection flaws share a root cause — SQLi, XSS, command injection all fail to separate code from data. Parameterized queries and output encoding are the primary defenses — input validation alone is insufficient.
• Patching requires process — Test, schedule, implement, validate, document exceptions. "Patch immediately" without testing creates production risk.
• Risk has four responses — Mitigate, accept (documented), transfer, or avoid. Each has appropriate use cases; undocumented "acceptance" is just an unmanaged vulnerability.
• Secure development prevents vulnerabilities at source — Threat modeling, SAST, parameterized queries, output encoding — security built in during development costs a fraction of what remediation costs post-deployment.

Connecting Forward

Phase 4 shifts perspective from proactive defense to active response. You've learned to find vulnerabilities before attackers; now you'll learn what to do when attackers find them first. Incident Response covers the frameworks for understanding attacks, the procedures for containing and eradicating them, and the lifecycle of preparation and post-incident learning that builds a more resilient organization over time.

Self-Check Questions

1. A scan identifies 500 vulnerabilities, 30 rated Critical. You have enough staff capacity to remediate 10 vulnerabilities per week. Using everything you've learned about prioritization, describe your triage process — what factors would you check for each Critical finding, and in what order would you begin remediation work?

2. Your web application has a SQL injection vulnerability in the user profile page. A developer proposes fixing it with a WAF rule that blocks requests containing ', --, and UNION. A security engineer says this isn't sufficient. Who is right, and why?