CSA Introduces VulnOps for Continuous Vulnerability Management
Cloud Security Alliance introduced VulnOps, a continuous vulnerability-management model that brings together vulnerabilities found during development, issues in deployed systems, and externally disclosed flaws. It recommends risk-based prioritization using factors such as public exposure, operational importance, exploit likelihood, and evidence of exploitation, alongside CISA’s KEV catalog and EPSS scores. When AI agents help validate or remediate vulnerabilities, CSA says their permissions should be restricted and sensitive actions require human approval.
VulnOps gives security teams an operational framework for managing vulnerabilities as AI accelerates discovery while preserving approval gates for testing, production deployment, and disclosure.
圖片來源:
CSA
AI加快漏洞發現速度，但企業確認漏洞影響、測試修補程式及部署更新仍需要時間。雲端安全聯盟（Cloud Security Alliance，CSA）提出VulnOps漏洞管理模式，主張企業不應只依賴定期掃描及批次修補，而應持續追蹤並處理漏洞，避免新發現的安全問題不斷累積。
VulnOps將三種來源的漏洞資訊納入同一套管理流程，包括軟體開發階段發現的安全問題、已部署系統中的漏洞，以及外部揭露的漏洞與供應商修補資訊。企業蒐集這些資訊後，需先排除重複項目，確認漏洞是否影響自身系統，再依據風險安排處理順序。CSA強調，企業不能只依通用漏洞評分系統（CVSS）分數決定修補優先順序，還須考量系統是否暴露於公開網路、對企業營運的重要性、漏洞遭到利用的可能性，以及是否已有實際利用的證據。企業也可參考美國網路安全暨基礎設施安全局（CISA）的已知遭利用漏洞清單（KEV）及漏洞利用機率評分系統（EPSS）等資訊。
#Cloud Security Alliance#VulnOps#CISA#Known Exploited Vulnerabilities Catalog#EPSS