CySA+
2.4Vulnerability Management · 26% of exam

Explain concepts related to control types, risks, and vulnerability management

Control types, risk management principles, secure coding, and the frameworks and standards that govern the programme.

Reading time
22 min read
Flashcards
20 cards
Practice questions
8 questions · 2 PBQs

This objective is the frame around the previous three: the vocabulary of controls, the discipline of changing systems safely, and the frameworks that say what a programme must contain.

It is broad and shallow. Learn the classifications precisely — the exam tests them as classifications — and learn the change process as a sequence.

Classifying controls two ways

Every control gets classified twice, and the exam expects both answers for the same control.

By nature — who or what implements it:

  • Managerial — policy, risk assessments, security planning. People deciding.
  • Operational — awareness training, incident response, physical security. People doing.
  • Technical — firewalls, encryption, access control lists. Systems enforcing.

By function — what it does relative to the event:

  • Preventive — stops it happening. A firewall rule, MFA.
  • Detective — notices it happened. A SIEM alert, log review.
  • Corrective — fixes it afterwards. Restoring from backup, patching.
  • Deterrent — discourages the attempt. Warning banners, visible cameras.
  • Compensating — an alternative when the primary control is not possible.

Compensating control

A control put in place because the intended one cannot be. It must provide comparable protection, and it does not remove the underlying deficiency. Network isolation and enhanced monitoring around an unpatchable legacy system is the canonical example.

Changing systems without breaking them

Patching is where vulnerability management meets operations, and the sequence is examinable:

  1. Test in a non-production environment that resembles production
  2. Plan the rollback before deploying — decide in advance how to undo it
  3. Implement through the change process, in the agreed window
  4. Validate that the patch applied and the system still works
  5. Rescan to confirm the finding is actually closed

Maintenance window

An agreed period when changes may be made and disruption is tolerated. It is negotiated with the business, and it is the practical limit on how fast remediation can move.

Exception

A formal, time-bounded record that a system will not comply with a requirement, with a reason and an owner. Exceptions make non-compliance visible and reviewable — an exception with no expiry date is just a permanent hole with paperwork attached.

Configuration management

Knowing and controlling the configuration of every system, so drift from the approved baseline is detectable. Without it, you cannot tell whether a control is still applied — you can only tell that it was applied once.

Building software that is not vulnerable

Vulnerability management is cheaper the earlier it happens, which is why secure development is in this domain at all.

Secure SDLC

Building security into every phase — requirements, design, implementation, testing, deployment, maintenance — rather than testing for it at the end. A flaw found in design costs a conversation; the same flaw found in production costs an incident.

Threat modelling

Systematically asking, at design time, what could go wrong: what are we building, what can go wrong with it, what are we doing about it, did we do a good enough job. STRIDE is the common taxonomy — spoofing, tampering, repudiation, information disclosure, denial of service, elevation of privilege.

The secure coding practices that appear by name:

PracticeWhat it prevents
Input validationInjection of all kinds — validate on the server, allow-list not deny-list
Parameterised queriesSQL injection, by separating code from data structurally
Output encodingCross-site scripting, by rendering data as data
Session managementSession hijacking and fixation
Authentication and authorisationBroken access control — the most common serious web flaw
Error handlingInformation disclosure through verbose errors
Data protectionExposure of data at rest and in transit

Check yourself

Which control most reliably prevents SQL injection?

Attack surface management

Continuously identifying and reducing everything an attacker could reach — exposed services, forgotten subdomains, shadow IT, third-party integrations. The smallest attack surface is the one you never have to defend.

Frameworks worth recognising

FrameworkWhat it is
NIST Cybersecurity FrameworkIdentify, Protect, Detect, Respond, Recover — voluntary, widely adopted, good for structuring a programme
NIST Risk Management FrameworkA formal seven-step process, mandatory for US federal systems
ISO/IEC 27001An international, certifiable standard for an information security management system
OWASP Top 10The consensus list of the most critical web application risks
PCI DSSMandatory for organisations handling cardholder data; prescriptive, including scan cadence
CIS Controls / BenchmarksPrioritised actions and concrete hardening configurations

Check yourself

An organisation must certify its information security management system to an international standard recognised by its overseas customers. Which framework fits?