# Vulnerability Management Models Using a Common Vulnerability Scoring System
## 2 Background  
It is noted first that, in what follows, the reader is expected to be familiar with such terms as CVE and CVSS, which are essential to understanding the vulnerability management process; cf., for instance, [9]. Current corporate networks consist of thousands of devices and applications with a variety of entities, such as office networks, financial and HR systems, and specialized configurations, which include control over production processes, telecommunication systems, or environmental controls [15]. If any of these entities do not work properly or are temporary unavailable, a company may suffer potentially high losses [8]. An illustrative example is the vulnerability CVE-2017-0143 [16], which is referred to by researchers as ETERNALBLUE. This vulnerability was a basis for hackers to create the _ransomware WannaCry_. This malware irretrievably encrypted thousands of terabytes of data in a short period of time and caused financial losses in corporations such as Nissan and FedEx [17,18], thus highlighting the importance of the proper implementation of vulnerability management process.  
In experienced organizations, the vulnerability management process enables the risk associated with the use of known vulnerabilities to be kept at the lowest possible level [19]. The main purpose is to monitor and identify new threats (for hardware or software) that may have an impact on the confidentiality, integrity, or accessibility of an IT organization's assets. The vulnerability management process is also a central point for collecting and approving exceptions regarding a vulnerability fix.  
The vulnerability management process is continuous and is repeated each time that the previous cycle ends. The process is cyclical, since new threats occur every day. This is because the infrastructure is dynamic, and hence, new configurations introduced in a network device may cause a new vulnerability. Thus, one or even several completed cycles may not be enough for a company to ascertain that the process of vulnerability elimination was successfully completed.  
In order to increase effectiveness of the vulnerability management process, the authors of [10] suggested the introduction of the following positions and responsibilities in an organization:  
* Head of security--a person responsible for, among other things, the vulnerability management process in the organization;
* Security engineer--a person responsible for conducting scans according to the process;
* Asset owner--a person responsible for IT assets that are scanned in the process; moreover, the asset owner decides whether the vulnerability will be fixed or the corresponding risk will be accepted. This is frequently a businessperson;
* Asset administrator--a person responsible for implementing recommendations, which are the results of scans and the vulnerability management process.  
Specifying the scope of responsibilities for all people involved in the vulnerability management process is important. The number of people involved in the process depends on the size and context of an organization. In a small organization, the scope of responsibilities will be increased. For example, the owner of a company may also be the head of security and the asset owner, while an employee can be the security engineer and asset administrator. Nevertheless, the vulnerability management process will be unchanged. One person should never hold all four positions, as the decisions made regarding a risk or vulnerability fix will never be sufficiently objective. Analogically, for a large organization with a greater number of employees available, the number of people involved in the process will accordingly increase; thus, the scope of responsibilities should be strictly defined.