Each time a vulnerability assessment team shares the regular report with other teams, inconsistencies regarding versions and patches in the existing…

The core issue described is a lack of a consistent, shared understanding of the IT infrastructure across different teams, leading to disagreements when vulnerability reports are reviewed. Implementing a central place to manage IT assets, such as a Configuration Management Database (CMDB) or an asset inventory system, establishes a single, authoritative source of truth. This ensures that the vulnerability assessment team, system administrators, and other stakeholders are all working from the same baseline data regarding hardware, software versions, and patch status. This foundational step directly resolves the root cause of the inconsistencies between teams.

A. Implementing credentialed scanning: While credentialed scanning provides more accurate data for the vulnerability report, it does not solve the underlying problem of different teams having inconsistent views of the asset inventory itself.

B. Changing from a passive to an active scanning approach: This changes the data collection method but does not address the foundational need for an agreed-upon asset inventory, which is the source of the inter-team inconsistencies.

D. Performing agentless scanning: This is a deployment choice for how scans are conducted. It does not inherently solve the problem of inconsistent asset information between different organizational teams.

---

1. National Institute of Standards and Technology (NIST). (2020). Security and Privacy Controls for Information Systems and Organizations (Special Publication 800-53

Revision 5).

Section: Control CM-8

Information System Component Inventory.

Content: This control mandates the development and maintenance of an inventory of system components. The discussion section states

"The inventory of information system components is essential for many other security controls

such as... flaw remediation (SI-2)... An accurate and up-to-date inventory is a prerequisite for an effective security program." This highlights that a central inventory is foundational for vulnerability management.

2. Fling

R.

& Schmidt

D. C. (2009). An Integrated Framework for IT Asset and Security Configuration Management. Proceedings of the 42nd Hawaii International Conference on System Sciences.

Section: 3. An Integrated Framework for IT Asset and Security Configuration Management.

DOI: https://doi.org/10.1109/HICSS.2009.105

Content: The paper argues that effective security management is impossible without accurate asset management. It states

"Without an accurate and up-to-date inventory of IT assets

it is impossible to effectively manage their security configurations... Discrepancies between discovered and recorded information can then be identified and reconciled." This directly supports using a central asset repository to resolve inconsistencies.

3. Kim

D.

& Solomon

M. G. (2021). CompTIA CySA+ Cybersecurity Analyst Certification All-in-One Exam Guide

Second Edition (Exam CS0-002). McGraw-Hill. (Note: While a commercial book

its principles are derived from and align with official CompTIA objectives and are widely used in academic settings as courseware. The principle is directly applicable to CS0-003).

Chapter 3: Vulnerability Management.

Content: The text emphasizes that the vulnerability management lifecycle begins with asset inventory. It explains that knowing what assets exist on the network is a prerequisite for scanning them and managing their vulnerabilities effectively. This establishes the central asset inventory as the starting point for reducing discrepancies.