# Improving Vulnerability Management Through Process Mining
## 2 Vulnerability Management  
The National Institute of Standards and Technology of the US Government (NIST) defines a vulnerability as a \"weakness in an information system, system security procedures, internal controls, or implementation that could be exploited or triggered by a threat source\" [1]. Examples for such weaknesses are bugs in software and misconfigurations, but also intended features that can be misused [11]. Vulnerabilities can be exploited by attackers to gain access to a network, install malware, access confidential data, and more. Each vulnerability is a potential entry point for an attacker. It is therefore vital for an organization to become aware of its vulnerabilities and fix them as quickly as possible, reducing opportunities for attackers [12]. According to NIST's National Vulnerability Database (NVD), each vulnerability is recorded with a CVE identifier including the year of its publication, a CVSS score rating its criticality, and a description in a standardized format [13]. CVSS is the Common Vulnerability Scoring System, which tries to standardize the severity of vulnerabilities [14], assigning either critical, high, medium, or low. According to cve.org [15], a website dedicated to identifying, defining, and cataloging published vulnerabilities, the number of published vulnerabilities per year has significantly increased since 2017, with around 14,500 vulnerabilities in 2017, around 20,000 in 2021, and 25,000 in 2022. This increase in vulnerabilities can be explained by the continuous digitalization efforts enlarging the IT landscape where vulnerabilities are identified. Additionally, the increase in hacking activities exploiting these vulnerabilities and also the increase in security experts actively looking for vulnerabilities lead to a better documentation of them and an increase in NVD entries. To deal with the high amount of vulnerabilities and the requirement of a fast remediation with the limited resources of organizations, it is necessary to have efficient vulnerability management [16]. Vulnerability management is the process of managing vulnerabilities to minimize the risk that they pose to an organization. There are several different implementations of this process in the literature ([PERSON] [17], [PERSON] [18], and [PERSON] [19]):  
Preparation/asset management;  
Scanning;  
Analysis and prioritization;  
Remediation and monitoring. Initially, all assets that should be protected must be identified. The identified assets can then be categorized, e.g., by adding information about the owner, the operating system, or the use of the asset. Based on this information, the asset can be prioritized and critical assets can be defined [11]. In a second step, the identified assets are scanned for vulnerabilities [11]. There are two main types of scanning: authenticated and unauthenticated scans. Unauthenticated scans take an outsider's view by scanning the asset without being authenticated on it. They are therefore easy to set up and provide valuable information for external facing assets [20]. Authenticated scans dig deeper by scanning the asset with privileged access, showing what vulnerabilities can be exploited once an attacker is inside of a network of application [4; 20]. After scanning, the identified vulnerabilities need to be analyzed and prioritized [11]. Organizations can use the CVSS score for prioritization and adapt it with organization-specific information like asset criticality [14]. After prioritization, the vulnerabilities need to be remediated. The remediation should be monitored to keep it in a defined timeframe according to the prioritization and, after remediation, the fix should be verified manually or by a rescan [11]. Vulnerability management, after a long period of stagnation [21], has its focus on organizing the integration of risk and criticality ratings into asset inventories to increase the effectiveness of prioritizing remediation efforts [22].