إدارة الثغرات
تحديد الثغرات في الأصول التنظيمية وإدارتها.
يُعرَّف إدارة الثغرات بنتائج NIST CSF 2.0 الآتية: ID.RA-01 (Vulnerabilities in assets are identified, validated, and recorded); ID.RA-08 (Processes for receiving, analyzing, and responding to vulnerability disclosures are established). جدول المطابقة مُطابَق عبر جدول مطابقة منشور في ISO 27001, CIS v8.1, PCI DSS, CMMC, 800-53, HIPAA وNIS2. تحريري مُطابَق تحريريًا في SOC 2, GDPR, Essential Eight, DORA, CPS 234 وCyber Essentials.
| الإطار | المتطلب | العنوان | رابط | المصدر / السبب |
|---|---|---|---|---|
| NIST CSF 2.0 | ID.RA-01ID.RA-08 | Vulnerabilities in assets are identified, validated, and recorded; Processes for receiving, analyzing, and responding to vulnerability disclosures are established | تعريف الموضوع | ID.RA-01 ID.RA-08 |
| ISO 27001 | A.8.8 | Management of technical vulnerabilities | جدول المطابقة | A.8.8: via ID.RA-01; NIST 800-53 map: RA-5 |
| CIS v8.1 | CIS 7.1CIS 7.2CIS 7.5CIS 7.6CIS 7.7CIS 16.6CIS 18.1CIS 18.2CIS 18.3CIS 18.4CIS 18.5 | Establish and Maintain a Vulnerability Management Process; Establish and Maintain a Remediation Process; Perform Automated Vulnerability Scans of Internal Enterprise Assets… | جدول المطابقة | CIS 7.1: via ID.RA-01 CIS 7.2: via ID.RA-08 CIS 7.5: Editorial (CIS's published crosswalk covers 49 of 153 safeguards): automated vulnerability scans of internal assets. CIS 7.6: Editorial (CIS's published crosswalk covers 49 of 153 safeguards): automated vulnerability scans of external assets. CIS 7.7: Editorial (CIS's published crosswalk covers 49 of 153 safeguards): remediate detected vulnerabilities. CIS 16.6: Editorial (CIS's published crosswalk covers 49 of 153 safeguards): a severity rating process for application vulnerabilities. CIS 18.1: Editorial (CIS's published crosswalk covers 49 of 153 safeguards): a penetration testing programme. CIS 18.2: Editorial (CIS's published crosswalk covers 49 of 153 safeguards): periodic external penetration tests. CIS 18.3: Editorial (CIS's published crosswalk covers 49 of 153 safeguards): remediate penetration test findings. CIS 18.4: Editorial (CIS's published crosswalk covers 49 of 153 safeguards): validate security measures after penetration tests. CIS 18.5: Editorial (CIS's published crosswalk covers 49 of 153 safeguards): periodic internal penetration tests. |
| SOC 2 | CC7.1 | Detecting configuration changes and new vulnerabilities | تحريري | CC7.1: AICPA's TSC mappings are not openly licensed; ControlMapping editorial mapping (criterion summaries are ours, not AICPA text). |
| PCI DSS | 6.3.111.3.111.3.2 | Vulnerabilities identified and risk-ranked; Internal vulnerability scans every three months; External ASV scans every three months | جدول المطابقة | 6.3.1: via ID.RA-01 11.3.1: via ID.RA-01 11.3.2: via ID.RA-01 |
| CMMC | RA.L2-3.11.2RA.L2-3.11.3 | Vulnerability Scan; Vulnerability Remediation | جدول المطابقة | RA.L2-3.11.2: via 800-171r3 03.11.02 ↔ ID.RA-01, ID.RA-08 → RA-5; 800-171r2 Appendix D → RA-5 RA.L2-3.11.3: via 800-171r3 03.11.02 ↔ ID.RA-01, ID.RA-08 → RA-5; 800-171r2 Appendix D → RA-5 |
| 800-53 | RA-5CA-8 | Vulnerability Monitoring and Scanning; Penetration Testing | جدول المطابقة | RA-5: via ID.RA-01; ID.RA-08 CA-8: via ID.RA-01 |
| HIPAA | §164.308(a)(1)(ii)(A)§164.308(a)(1)(ii)(B)§164.308(a)(8) | Risk Analysis; Risk Management; Evaluation | جدول المطابقة | §164.308(a)(1)(ii)(A): The HIPAA risk analysis must identify vulnerabilities to ePHI; HHS guidance treats vulnerability identification as part of it. §164.308(a)(1)(ii)(B): Risk management requires reducing identified risks and vulnerabilities to a reasonable level, which is where remediation sits in HIPAA. §164.308(a)(8): via NIST HIPAA map: CA-8 |
| GDPR | Art.32(1)(d) | Security of processing | تحريري | Art.32(1)(d): No official crosswalk exists for GDPR; ControlMapping editorial mapping. |
| NIS2 | 6.56.10 | Security testing; Vulnerability handling and disclosure | جدول المطابقة | 6.5: via ID.RA-01 6.10: via ID.RA-01; ID.RA-08; ENISA ISO map: A.8.8 |
| Essential Eight | ISM-1807ISM-1808ISM-1698ISM-1699ISM-1701ISM-1702 | An automated method of asset discovery is used at least fortnightly to support the…; A vulnerability scanner with an up-to-date vulnerability database is used for…; A vulnerability scanner is used at least daily to identify missing patches or updates for vulnerabilities in online…… | تحريري | ASD assigns these ISM controls to the Essential Eight; ASD publishes no crosswalk to NIST or ISO, so linking them to topics is ControlMapping editorial. |
| DORA | Art.8(2)Art.25(1)Art.26(1)Art.27(1) | Identification; Testing of ICT tools and systems; Advanced testing of ICT tools, systems and processes based on TLPT… | تحريري | Art.8(2): Assess ICT vulnerabilities on a continuous basis. Art.25(1): Testing includes vulnerability assessments and scans, and penetration testing. Art.26(1): Entities selected by their authority run threat-led penetration testing (TLPT) at least every three years. Art.27(1): Testers carrying out TLPT must be suitable, technically capable, certified or bound by a code of conduct, and insured. |
| CPS 234 | Para 17Para 27Para 30 | Keep capability current as threats and vulnerabilities change; Systematic testing programme for control effectiveness; Testing by skilled, functionally independent specialists | تحريري | Para 17: Actively maintain the security capability as vulnerabilities change. Para 27: A systematic testing programme whose frequency follows how fast vulnerabilities and threats change. Para 30: Testing by appropriately skilled and functionally independent specialists. |
| Cyber Essentials | CE 3 | Security Update Management | تحريري | CE 3: Fix known vulnerabilities: updates rated critical or high risk (CVSS v3 7 or above) within 14 days, and no unsupported software. |
تعريف الموضوع نتائج CSF 2.0 التي تحدد هذا الموضوع · جدول المطابقة اختيار واحد على الأقل مدعوم بجدول مطابقة منشور · تحريري حكم ControlMapping، مع ذكر السبب · غير مربوط، يشترك فقط في نتائج CSF لهذا الموضوع · لا يوجد ربط في بياناتنا لا يوجد ربط في بياناتنا؛ غالباً عمل جديد، لكن راجع ملاحظات التغطية. المنهجية.
تُعرض معرّفات المتطلبات وعناوينها كما تنشرها كل جهة معيارية، باللغة الإنجليزية.
ربط خاطئ أو مفقود؟ أبلغ عنه
حول إدارة الثغرات
إدارة الثغرات عملية مستمرة تشمل اكتشاف الثغرات الأمنية في البنية التحتية للمؤسسة وتطبيقاتها ونقاط نهايتها، وترتيبها حسب الأولوية، ومعالجتها. تستخدم البرامج الفعّالة أدوات فحص آلية لتحديد الثغرات، وتعتمد على ترتيب الأولوية وفق المخاطر (مثل درجات CVSS مقرونةً بأهمية الأصل وتوفر استغلال الثغرة) لتركيز جهود المعالجة، إضافةً إلى اتفاقيات مستوى الخدمة (SLA) المحددة لمواعيد الترقيع. وتتحقق التقييمات الدورية للثغرات واختبارات الاختراق من فعالية جهود المعالجة، ومن أن الثغرات الجديدة تُكتشف في وقت مناسب.