Vulnerability Assessment

Learning Objectives Define what a vulnerability is and distinguish it from a threat and a risk. Identify at least three common types of vulnerabilities in software and websites. Explain the four main steps of a vulnerability assessment process. Use a simple formula to calculate a basic risk score for a given vulnerability. Analyze a simple system (like a login page) and list potential vulnerabilities. Describe the purpose of a CVE (Common Vulnerabilities and Exposures) list. Have you ever left your front door unlocked? 🚪 A vulnerability in a computer system is like an unlocked door, just waiting for someone to walk through! In this lesson, you'll become a digital detective! We will learn how to find these 'unlocked doors' in computer systems through a proces...

TermDefinitionExample VulnerabilityA weakness or flaw in a computer system, software, or process that could be exploited (taken advantage of) by a threat.A website's login form that doesn't check for a strong password, allowing someone to easily guess it. ThreatAny potential danger that can exploit a vulnerability. This could be a person (like a hacker) or an event (like a power outage).A hacker who actively tries to guess weak passwords on a website. RiskThe potential for loss or damage when a threat exploits a vulnerability. It's the combination of the likelihood of something bad happening and the impact if it does.The high risk of student accounts being taken over because of the weak password vulnerability and the presence of hackers trying to exploit it. ExploitA piece...

The Vulnerability Assessment Cycle 1. Identify Assets -> 2. Scan for Vulnerabilities -> 3. Analyze and Prioritize -> 4. Report and Remediate This is the standard four-step process for conducting a vulnerability assessment. You must first know what you're protecting (assets), then find the weaknesses (scan), figure out which ones are most important (analyze), and finally, report them so they can be fixed (remediate). Basic Risk Score Formula Risk = Likelihood x Impact Use this simple formula to prioritize vulnerabilities. 'Likelihood' is how likely the vulnerability is to be exploited (e.g., 1-10 scale). 'Impact' is how bad the damage would be if it were exploited (e.g., 1-10 scale). A higher score means a higher priority to fix.