Very interesting and comprehensive discussion of vulnerability management.

Where I am currently struggling is to identify the vulnerabilities present in a specific software version. I have not had much luck with the Cisco website so far.

In this instance I am trying to make an assessment of the cumulative vulnerabilities present in ASA 8.4 (3.8), and there doesn't seem to be any tool / site where I can search for this - Any ideas would be very appreciated. Clearly the vulnerablities need to be considered in the context of other controls - as you discuss :-)