4 Vulnerabilities and Risk Free Online FlashCards

What is a vulnerability?

A vulnerability is a weakness in a system, its implementation, or its security procedures that a threat source could exploit or trigger.

What does vulnerability severity describe?

Severity describes a vulnerability’s potential technical impact.

What does exploitability measure?

Exploitability describes how feasible it is for an attacker to use a vulnerability. Remoteness, authentication, required user actions, and available exploit code can affect it.

What does exposure describe?

Exposure describes how reachable or accessible a vulnerable asset is to potential attackers.

What does a vulnerability assessment commonly involve?

It identifies and evaluates weaknesses, commonly using an asset and software inventory, scans, reliable vulnerability information, and validation of important findings.

What factors guide vulnerability prioritization?

Consider severity and impact, exploitability and threat evidence, exposure and safeguards, asset importance and scope, and available response options.

How do remediation and mitigation differ?

Remediation fixes the issue, such as by applying a patch or changing the system. Mitigation temporarily limits risk, for example by restricting access or isolating the asset; teams should verify the response worked.

Does finding a vulnerability mean a system was compromised?

No. A vulnerability creates the possibility of harm, but it does not by itself mean the system has been compromised.

What factors do CVSS Base metrics consider?

CVSS Base metrics consider how an attacker can reach the flaw, required privileges or user interaction, and potential effects on confidentiality, integrity, and availability.

Does a CVSS score fully measure organizational risk?

No. A CVSS score helps compare technical severity, but it is not a complete measure of risk for every organization.

What two elements does risk combine?

Risk combines the chance that a threat will exploit a vulnerability with the consequences for the affected organization.

Do exposure-reducing controls necessarily remove a vulnerability?

Network segmentation, access restrictions, and disabling an unnecessary service can reduce exposure or limit harm, but may not remove the underlying vulnerability.