Topics in this domain
- Risk Management Concepts and Frameworks
- Inherent Risk, Residual Risk, Appetite and Tolerance
- Threat Actors, Motivations and Attack Vectors
- The Evolving Threat Landscape: AI, Cloud and Supply Chain
- Threat Modelling and Cyber Threat Intelligence
- Vulnerability Assessment and Scanning
- Control Deficiencies and Security Gap Analysis
- The Risk Assessment Process
- Qualitative Risk Analysis: Likelihood and Impact
- Quantitative Risk Analysis: SLE, ALE and Loss Estimation
- Risk Scenarios and Prioritisation
- Risk Treatment Options: Mitigate, Transfer, Avoid, Accept
- Risk Acceptance: Approval, Expiry and Review
- Cost-Benefit Analysis for Risk Treatment
- Risk Ownership vs Control Ownership
- RACI and Risk Escalation Paths
- The Risk Register
- Continuous Risk Monitoring and Key Risk Indicators
- Risk Reporting to Executives and the Board
- Integrating Risk Management into Business and IT Processes
Vulnerability Assessment and Scanning
Why it matters to risk
Risk needs a threat, a vulnerability and an asset. Vulnerability assessment finds the weaknesses, so the security manager knows where threats could get in and can fix what matters most first. One CISM task is to participate in and/or oversee the vulnerability assessment and threat analysis process.
Not just missing patches
| Type | Examples | How it’s found |
|---|---|---|
| Technical | Missing patches, misconfiguration, weak encryption, insecure code | Scanning, configuration reviews, code analysis, penetration tests |
| Process | No leaver process, unapproved changes, untested backups | Process reviews, audits, incident lessons |
| People | Phishing susceptibility, key-person dependency, missing skills | Phishing simulations, skills assessments |
| Physical | Unlocked server rooms, no visitor control, a single power feed | Site inspections |
Scanning methods
| Method | What it gives |
|---|---|
| Authenticated (credentialed) | A deep view: installed software, missing patches, settings |
| Unauthenticated | What an outsider sees; misses many issues |
| External vs internal | Internet exposure vs what an insider or intruder could reach |
| Web application (DAST) | Flaws such as injection in running applications |
| Agent-based | A continuous view of laptops and cloud servers that move around |
| Cloud posture (CSPM) | Misconfigured cloud services, such as public storage |
Prioritise by risk
The severity score (CVSS) alone is a poor guide. Prioritise using:
- severity: the CVSS base score
- active exploitation: is it on a known-exploited list such as CISA’s KEV catalogue, and how likely is exploitation (the EPSS score)?
- exposure: internet-facing or internal?
- asset criticality: what does the system hold or run?
- compensating controls: segmentation, a web application firewall, monitoring
Example. Scans report 3,000 “critical” findings. Filtering for internet-facing systems with known-exploited vulnerabilities leaves 40. The team fixes those within 7 days and schedules the rest by asset criticality.
The program
- Inventory every asset. You can’t scan what you don’t know about.
- Scan regularly and after significant changes.
- Prioritise by risk.
- Remediate through owners with agreed deadlines (service levels by severity).
- Verify by rescanning.
- Report trends, overdue items and accepted exceptions to management.
Systems that can’t be patched need compensating controls (isolation, monitoring) and documented risk acceptance.
Vulnerability assessment finds weaknesses. Penetration testing goes further and tries to exploit them, which is covered in Domain 3.
How the exam asks about it
| If the question asks… | The answer is usually… |
|---|---|
| Prerequisite for vulnerability scanning | An accurate asset inventory |
| Type of scan that finds the most | Authenticated (credentialed) |
| How to prioritise vulnerabilities | By risk: exploitability, exposure and asset criticality |
| What a clean scan means | No known issues were found, not that the system is secure |
| A system that can’t be patched | Compensating controls and documented risk acceptance |
In short
- Vulnerability assessment identifies weaknesses that threats could exploit; it feeds the risk assessment and remediation plans.
- Vulnerabilities aren't only technical: processes, people and physical facilities have weaknesses too.
- Scanning methods: authenticated vs unauthenticated, internal vs external, network, web application, agent-based, cloud configuration.
- Prioritise by risk: severity (CVSS), active exploitation (known-exploited lists, EPSS), exposure, asset criticality and compensating controls.
- A complete, current asset inventory comes first; you can't scan what you don't know about.
- Track remediation against agreed timelines and rescan to verify fixes.
Exam traps
- Fixing purely by CVSS score ignores exploitation and business criticality.
- A clean scan only means no known issues were found by that scan.
- Unauthenticated scans miss many vulnerabilities that authenticated scans find.
- Vulnerability assessment finds weaknesses; penetration testing tries to exploit them. Don't confuse the two.
Slides
Click the slide and use the arrow keys. F toggles full screen.
Not just missing patches
Prioritise by risk
ExampleScans report 3,000 'critical' findings. Filtering for internet-facing systems with known-exploited vulnerabilities leaves 40. The team fixes those within 7 days, and schedules the rest by asset criticality.
1 / 9