vulnerability analysis

Vulnerability analysis, also known as vulnerability assessment, is a process that defines, identifies, and classifies the security holes (vulnerabilities) in a computer, network, or communications infrastructure. In addition, vulnerability analysis can forecast the effectiveness of proposed countermeasures and evaluate their actual effectiveness after they are put into use.

Vulnerability analysis consists of several steps:

• Defining and classifying network or system resources
• Assigning relative levels of importance to the resources
• Identifying potential threats to each resource
• Developing a strategy to deal with the most serious potential problems first
• Defining and implementing ways to minimize the consequences if an attack occurs.

If security holes are found as a result of vulnerability analysis, a vulnerability disclosure may be required. The person or organization that discovers the vulnerability, or a responsible industry body such as the Computer Emergency Readiness Team (CERT), may make the disclosure. If the vulnerability is not classified as a high level threat, the vendor may be given a certain amount of time to fix the problem before the vulnerability is disclosed publicly.

The third stage of vulnerability analysis (identifying potential threats) is sometimes performed by a white hat using ethical hacking techniques. Using this method to assess vulnerabilities, security experts deliberately probe a network or system to discover its weaknesses. This process provides guidelines for the development of countermeasures to prevent a genuine attack.

Read more about vulnerability analysis: - Primatech, Inc. describes the technical aspects of industrial cyber security vulnerability analysis. - Ronda R. Henning details the vulnerability analysis of wireless networks. - Writing.com has published an article entitled 'The Dark Side of White Hat Hacking.' - This SearchSecurity.com tip looks at vulnerability analysis service providers.

Do you have something to add to this definition? Let us know. Send your comments to techterms@whatis.com

Digg This!     StumbleUpon     Del.icio.us

RELATED CONTENT Security data lapses hamper researchers Accurate information on attacks and data breaches could boost research and drive innovation. Database patch denial: How 'critical' are Oracle's CPUs? A recent survey found that a considerable number of users are outright rejecting Oracle's Critical Patch Updates. Is attack code valuable for vulnerabilities or just a publicity stunt? If a security company has developed attack code for a particular vulnerability, there will always be critics that cry "PR stunt." Expert Michael Cobb...

RELATED GLOSSARY TERMS Terms from Whatis.com − the technology online dictionary gray hat  (SearchSecurity.com) risk analysis  (SearchSecurity.com) Risk analysis is the process of defining and analyzing the dangers to individuals, businesses, and government agencies posed by potential natural and...