







In September 2017, a large US firm announced a catastrophic breach of its systems that exposed personal information of over 145 million Americans and over 15 million UK customers.
A patch for the vulnerability was released a few months prior to the attack, yet the security updates were not applied. It’s believed that the hackers used an unpatched vulnerability in Apache Struts, one that had been disclosed and a patch released several months prior.
The cost to the firm has been immense. Millions of customers are at risk of identity theft; the CEO, CIO and CISO all lost their jobs; the full cost of remediation, including resolving government investigations and civil lawsuits, is estimated to be well over $600m US and the firm lost a quarter of its market value.
One of the key lessons from this breach is that you and your team should know what frameworks you have in your environment and be proactive when it comes to vulnerability management.
Unmitigated vulnerabilities
There have been a number of cyber attacks and data breaches in recent years that have highlighted the devastating impact that unmitigated vulnerabilities can cause, and the huge personal consequences for customers.
Click play to watch the video. When you have finished, continue scrolling down the page.

Best practice
Doug reviews some notes about the vulnerability, and discovers that if exploited, it can potentially result in a malicious cyber actor gaining unauthorised access to information.
A security patch (code-fix) has been released, but Doug is unsure what impact it could have on his service if implemented.
There are a couple of other mitigating controls that he can introduce to help protect the information in his service until the patch has been deployed.


Call to action
Let’s look at the key steps to take when dealing with a vulnerability.
Remember, the process of vulnerability management is always more effective when the Configuration Management Database (CMDB) is well-maintained.
The more records are kept up-to-date, the more robust our vulnerability management process can be.
Take a moment to reflect on the following steps in dealing with vulnerability and select any that you’d like to adopt.

Back at work
The following Vulnerability Management resources, including a list of Group-Wide exemptions, is available at One.CBA.
- Vulnerability management
- Technical vulnerability management standard
- Qualys Onboarding Process

Congratulations, you've finished Topic 6
Select the buttons below to continue.