Week 6 - Vulnerability Management and Security Assessment

Vocabulary flashcards covering key definitions, tools, scanning types, and distinctions from Unit 6 Vulnerability Management and Security Assessment.

Vulnerability

A weakness that a threat could exploit.

Threat

A person, event, or condition capable of causing harm.

Risk

The potential harm that could result if a threat exploits a vulnerability.

Control (Countermeasure)

A safeguard used to reduce the likelihood or impact of a security risk.

Vulnerability Management

The continuous process of identifying, evaluating, prioritizing, fixing, and verifying security weaknesses.

Vulnerability Management Cycle

Identify assets → find vulnerabilities → evaluate and prioritize them → remediate or mitigate → verify the fix → repeat.

Asset Inventory

An accurate list of systems, software, owners, locations, and other properties needed to manage security.

Why does vulnerability management start with asset inventory?

You cannot scan, patch, monitor, or assign responsibility for a system you do not know exists.

What should an asset inventory include?

System purpose, owner, hardware, operating system, network information, installed software, exposure, data sensitivity, and lifecycle information.

Vulnerability Assessment

A systematic process for identifying and evaluating weaknesses in systems or applications.

Vulnerability Scan

Automated testing that looks for known vulnerabilities, missing patches, unsafe configurations, or other indicators of weakness.

Penetration Testing

An authorized and scoped security test that actively attempts to exploit weaknesses to demonstrate real-world impact.

Internal Scan

A vulnerability scan performed from inside the organization or trusted network.

External Scan

A vulnerability scan performed from outside the organization to identify internet-exposed systems, services, and weaknesses.

Internal vs. External Scan

An internal scan shows what may be reachable after someone gets inside the network. An external scan shows what an internet-based attacker can see.

Credentialed Scan

A vulnerability scan performed with authorized login access, allowing deeper inspection of installed software, patches, and configuration.

Uncredentialed Scan

A vulnerability scan performed without host credentials that relies mainly on what can be observed from the network.

Credentialed vs. Uncredentialed Scan

A credentialed scan can inspect the system internally. An uncredentialed scan sees mainly the externally observable attack surface.

Why can a credentialed scan find more vulnerabilities?

It can directly inspect installed software, patch levels, and configuration instead of inferring them only from network responses.

CVE (Common Vulnerabilities and Exposures)

A standardized identifier used to refer to a specific publicly disclosed vulnerability.

CVE format

CVE-Year-Identifier. Example: CVE-2021-44228.

Is a CVE malware?

No. A CVE is an identifier for a known vulnerability.

NVD (National Vulnerability Database)

NIST's vulnerability database that adds standardized details, scoring information, affected products, weaknesses, and references to CVE records.

CVSS (Common Vulnerability Scoring System)

A scoring system used to communicate the technical severity of a vulnerability, typically on a scale from 0 to 10.

KEV (Known Exploited Vulnerabilities)

CISA's catalog of vulnerabilities with evidence of real-world exploitation, used as an important prioritization signal.

CVE vs. CVSS

CVE identifies the vulnerability. CVSS describes its technical severity.

CVE vs. NVD

CVE provides the standardized vulnerability identifier. The NVD adds analysis and additional vulnerability information.

CVSS vs. KEV

CVSS measures technical severity. KEV tells defenders that the vulnerability is known to be actively exploited.

False Positive

A vulnerability or security issue reported by a tool that is not actually present.

False Negative

A real vulnerability that an assessment or scanner fails to detect.

False Positive vs. False Negative

A false positive reports a problem that is not real. A false negative misses a real problem.

Remediation

Removing or correcting the underlying vulnerability, such as installing the required patch.

Mitigation

Reducing the risk around a vulnerability without fully removing the underlying weakness.

Compensating Control

An alternative safeguard used when the preferred security control cannot be implemented.

Risk Acceptance

A documented decision by authorized leadership to tolerate a known remaining risk.

Risk Transfer

Shifting some financial or operational impact of a risk to another party, such as through insurance or a contract.

Risk Avoidance

Removing the risky activity entirely so the associated risk no longer applies.

Remediation vs. Mitigation

Remediation removes the weakness. Mitigation reduces the risk while the weakness still exists.

Compensating Control vs. Remediation

A compensating control reduces risk when the preferred fix cannot be used. Remediation actually removes or corrects the weakness.

Rescan

A follow-up scan performed after remediation or mitigation to verify whether the vulnerability is gone or sufficiently controlled.

Why is a rescan important?

A closed ticket does not prove the vulnerability was fixed. A rescan or other validation confirms the actual security condition changed.

What proves remediation worked?

A rescan or other validation showing that the vulnerable condition is no longer present.

Technical Severity

The inherent technical seriousness of a vulnerability, often represented using CVSS.

Organizational Risk

The actual risk the vulnerability creates for a specific organization after considering business context.

Why is CVSS not the same as organizational risk?

CVSS describes technical severity, but real priority also depends on exposure, active exploitation, asset value, data sensitivity, existing controls, and business impact.

What factors should affect vulnerability priority?

Technical severity, internet exposure, active exploitation, asset criticality, data sensitivity, existing controls, and potential business impact.

Scan vs. Penetration Test

A vulnerability scan identifies likely weaknesses automatically. A penetration test actively attempts to demonstrate whether weaknesses can be exploited and what impact they could cause.

Threat vs. Vulnerability

A threat is a potential source of harm. A vulnerability is a weakness that the threat could exploit.

Vulnerability vs. Risk

A vulnerability is the weakness itself. Risk is the potential harm created if that weakness is exploited.

Threat vs. Risk

A threat is what could cause harm. Risk describes the likelihood and impact of that harm affecting the organization.

Nessus

A vulnerability scanner used to discover hosts and identify known vulnerabilities or configuration weaknesses.

What does a vulnerability scanner actually prove?

It reports possible or likely weaknesses. A scan result does not automatically prove that the weakness can be successfully exploited.

An internet-facing payroll server and an isolated lab PC have the same critical vulnerability. Which should be prioritized first?

The payroll server, because its exposure and business importance create greater organizational risk.

A medical device cannot be patched for 60 days. What is a reasonable interim response?

Segment the device, restrict allowed communication, increase monitoring, assign responsibility and a deadline, then patch and verify when possible.

A scanner reports software as vulnerable, but the vendor already backported the security fix. What is this?

A false positive.

A custom vulnerable application is not detected by the scanner. What is this?

A false negative.