説明
脆弱性評価を完了し、特定された脆弱性を修正した後、次のステップはネットワークを再スキャンして、脆弱性が正常に修正され、新しい脆弱性が導入されていないことを確認することです。脆弱性評価は、攻撃者に悪用される可能性のあるネットワーク、システム、またはアプリケーションの弱点と露出を特定して評価するプロセスです。脆弱性評価では通常、スキャナーなどの自動化ツールを使用してネットワークをスキャンし、結果のレポートを生成します。レポートには、脆弱性の重大度、影響、および修正などの情報が含まれる場合があります。運用チームは、適切なパッチ、更新、または構成を適用して脆弱性に対処し、ネットワークへのリスクを軽減する責任があります。再スキャンは、修復アクションが有効であり、ネットワークが安全であることを確認するために必要です。
Conducting an audit, initiating a penetration test, or submitting a report are not the next steps after completing a vulnerability assessment and remediating the vulnerabilities. An audit is a process of reviewing and verifying the compliance of the network with the established policies, standards, and regulations. An audit may be performed by internal or external auditors, and it may use the results of the vulnerability assessment as part of the evidence. However, an audit is not a mandatory step after a vulnerability assessment, and it does not validate the effectiveness of the remediation actions.
A penetration test is a process of simulating a real-world attack on the network to test the security defenses and identify any gaps or weaknesses. A penetration test may use the results of the vulnerability assessment as a starting point, but it goes beyond scanning and involves exploiting the vulnerabilities to gain access or cause damage. A penetration test may be performed after a vulnerability assessment, but only with the proper authorization, scope, and rules of engagement. A penetration test is not a substitute for a rescan, as it does not verify that the vulnerabilities have been fixed.
Submitting a report is a step that is done after the vulnerability assessment, but before the remediation. The report is a document that summarizes the findings and recommendations of the vulnerability assessment, and it is used to communicate the results to the stakeholders and the operations team. The report may also include a follow-up plan and a timeline for the remediation actions. However, submitting a report is not the final step after the remediation, as it does not confirm that the network is secure.
References = CompTIA Security+ SY0-701 Certification Study Guide, page 372-375; Professor Messer's CompTIA SY0-701 Security+ Training Course, video 4.1 - Vulnerability Scanning, 0:00 - 8:00.