Secure Software Systems

Vulnerability Assessment and Mapping

The goals of vulnerability assessment and vulnerability mapping are many:

• Identifying potential vulnerabilities of a system as early in the process as possible

• Influencing the design and development to minimize vulnerabilities that do appear in the system

• Determining the attack surface of a system

• Creating a vulnerability matrix

• Providing input into risk management and mitigation practices

• Driving security testing

BOX 12.1 Vulnerabilities

A vulnerability is a weakness in a system that has the potential to fail or otherwise be exploited thereby exposing the system to undesired performance, leakage of data, or other negative security problems.

The first two goals go hand in hand, as many potential ...