Glossary
Vulnerability management, in plain words
Short definitions of the terms you meet when ranking and fixing vulnerabilities.
- CIS Controls v8
- A prioritised list of security practices.
- CISA KEV
- The US catalog of vulnerabilities known to be exploited.
- CVE
- A public identifier for a specific security flaw.
- CVSS
- A 0 to 10 score for how severe a flaw is in theory.
- EPSS
- The probability that a CVE will be exploited soon.
- Four-eyes principle
- No sensitive action without a second person’s approval.
- ISO 27001 Annex A
- The control list of the ISO 27001 standard.
- Remediation plan
- The steps to fix a vulnerability, in order.
- Row-level security
- The database itself keeps one client’s data from another’s.
- Sigma rules
- A readable, open format for detection rules.
- Site collector
- A small agent inside a network that only connects outward.
- Vulnerability prioritisation
- Deciding which vulnerabilities to fix first.
- Wazuh
- An open-source security platform with agents on hosts.