Contents
What is vulnerability identification?
The vulnerability identification process enables you to identify and understand weaknesses in your system, underlying infrastructure, support systems, and major applications. It allows you to analyze the potential exposures generated by your supply chain and your business partners.
What is vulnerability and how is it identified?
A vulnerability is a flaw that could lead to the compromise of the confidentiality, integrity or availability of an information system. Vulnerability identification involves the process of discovering vulnerabilities and documenting these into an inventory within the target environment.
What’s the difference between a vulnerability assessment and exploitation?
This could be time consuming, but exploitation doesn’t, by definition, move you out of the realm of vulnerability assessment. The only key attributes of a VA vs. PT are list-orientation vs. goal-orientation, and the question of exploitation is simply not part of that calculation.
What is the difference between a threat and a vulnerability?
A threat is any potential occurrence, malicious or otherwise, that could harm an asset. In other words, a threat is any bad thing that can happen to your assets. A vulnerability is a weakness that makes a threat possible. This may be because of poor design, configuration mistakes, or inappropriate and insecure coding techniques.
Why is it important to know about vulnerabilities?
Exploits need vulnerabilities to exist, which is why preventing vulnerabilities is so important. Looking for vulnerabilities manually would be a laborious way of hacking, which is why hackers use automated tools to attack vulnerabilities at mass scale. For many hackers, exploiting vulnerabilities is very much a numbers game.
Can a vulnerability be created by a phishing email?
A vulnerability can also be created by a cyber attack, such as a phishing email with a link that tricks or manipulates you into downloading files containing malicious software or code. How the vulnerability is created doesn’t change the fact that there is a weakness that hackers could potentially exploit.