Today while reviewing vulnerability scan results with a colleague, we had a debate about what vulnerabilities can be considered "true or legitimate" and hence worthwhile to spend resources in monitoring. We had a differing opinion on whether vulnerabilities without a relevant attack vector can be considered "true" vulnerabilities for our company
My opinion was that even if a vulnerability discovered today has no applicable attack vectors because conditions needed to exploit it does not exist, the vulnerability is still worthy of monitoring as its future behavior may evolve. As more information is known about it, more attack vectors may become known. In addition, our company is moving in the direction of the Cloud, where I see faster detection and stronger monitoring of vulnerabilities in becoming more important, due to there being more "distance" between a company and its digital assets. I.e: Assets become less physically tangible.
However, I also understand my college's point of monitoring and researching having a opportunity cost. If the probability of successful exploit is unlikely, then the time spent researching, monitoring, and reporting results may be better spent on another activity, similar to not how all security risks have equal criticality.
Given our company's direction, that we work with highly sensitive customer data such as health information (HIPPA), and we are in the regulated financial services industry, I tend to feel more comfortable by taking the more conservative approach of my own viewpoint.
In general, are vulnerabilities with non applicable attack vectors considered "true" vulnerabilities?
How should the degree of monitoring and resource commitment to remediation be determined general speaking at a high level, particularly for regulated industries?