Managing Risk in Information Systems, 3rd Edition

Vulnerability Assessments

A vulnerability assessment is performed to identify vulnerabilities within an organization. Vulnerabilities are any weaknesses in an IT infrastructure. They can exist for a specific server, for entire networks, or with personnel.

For example, a single web server could be vulnerable to a buffer overflow attack. For example, a buffer overflow bug was discovered in May. If the web server is not patched until July, it will remain vulnerable between May and July.

NOTE

A buffer overflow attack occurs when an attacker sends more data or different data than a system or application expects. Buffer overflow vulnerabilities ...