Vulnerability Management - Remediation vs Mitigation

Do not use these terms interchangeably !! So .. Let's understand them and see the differences.

Remediating a vulnerability means fixing or eliminating it, dealing with the root cause of the vulnerability. Mitigating a vulnerability, on the other hand, means finding a temporary solution or workaround to decrease the possibility of a vulnerability being exploited.

However, sometimes remediation isn’t possible for several reasons such as the following:

1. A fix, patch or an updated version of the software is not available immediately, since it takes time for the vendors to prepare and distribute them.

2. Not all vulnerabilities need to be fixed. This is usually the case when a vulnerability does not pose a threat since it is not directly accessible or exploitable by a threat actor. For instance, the vulnerable software could be disabled on the Internet connected devices while running only on the not connected devices.

3. Due to managerial issues, you could be hindered from applying a remediation action. This usually happens when a company has strict QoS requirements on customer facing systems and cannot tolerate any downtime required to patch a vulnerability or update a software.

4. Due to some restrictions, such as compatibility issues with other software being used in a system, a fix or patch cannot be applied at all.

Actions to mitigate a vulnerability could be one or some of the following:

1. Blocking a port on a firewall (on a network or host) that could expose a vulnerability to malicious actors.

2. Limiting the use of the vulnerable software to a separated network or a selected list of users.

3. Disabling the vulnerable software temporarily.

Please refer the below URL for more information:

https://cybersophia.net/articles/what-is/vulnerability-mitigation-vs-remediation/#:~:text=To%20sum%20up%2C%20remediation%20is,it%20cannot%20be%20eliminated%20immediately.

Happy Learning !!