Best practices for vulnerability management