Vulnerability Assessment

Vulnerability Assessment

A vulnerability assessment is the process of identifying, quantifying, and prioritizing (or ranking) the vulnerabilities in a system. Examples of systems for which vulnerability assessments are performed include, but are not limited to, information technology systems, energy supply systems, water supply systems, transportation systems, and communication systems. Such assessments may be conducted on behalf of a range of different organizations, from small businesses up to large regional infrastructures. Vulnerability from the perspective of disaster management means assessing the threats from potential hazards to the population and to infrastructure. It may be conducted in the political, social, economic or environmental fields.

Vulnerability analysis consists of several steps:

  • Defining and classifying network or system resources
  • Assigning relative levels of importance to the resources
  • Identifying potential threats to each resource
  • Developing a strategy to deal with the most serious potential problems first
  • Defining and implementing ways to minimize the consequences if an attack occurs.

If security holes are found as a result of vulnerability analysis, a vulnerability disclosure may be required. The person or organization that discovers the vulnerability, or a responsible industry body such as the Computer Emergency Readiness Team (CERT), may make the disclosure. If the vulnerability is not classified as a high level threat, the vendor may be given a certain amount of time to fix the problem before the vulnerability is disclosed publicly.

The third stage of vulnerability analysis (identifying potential threats) is sometimes performed by a white hat using ethical hacking techniques. Using this method to assess vulnerabilities, security experts deliberately probe a network or system to discover its weaknesses. This process provides guidelines for the development of countermeasures to prevent a genuine attack.

Importance and relevance to an enterprise

Understanding security risk on a global enterprise network is essential to comprehensive IT risk management and creating confidence in your security program. However, the high rate of change on enterprise networks, the constantly changing threat environment, and increased focus on internal and regulatory compliance have made this task increasingly difficult. Accurate identification of vulnerabilities and effective prioritization is the only answer to effectively dealing with this challenge. Integrated web application scanning. Today’s threat environment is unimaginably dynamic —with thousands of new vulnerabilities reported annually—the sheer volume of launched attacks demands best-in-class enterprise vulnerability management solutions to provide comprehensive discovery and management of critical vulnerabilities in support of the IT security lifecycle. Up-to-date vulnerability management is critical, especially as the time between vulnerability discovery and the release of an exploit is, in some cases, narrowing to zero. Furthermore, evolving technology constantly increases attack vectors into the enterprise, increasing the number of vulnerabilities and required patches across the entire network.