Topics in this domain
- IT Risk Events, Loss Types and Business Outcomes
- Threat Sources, Actors and Motivations
- The Changing Threat Landscape and Threat Modelling
- Vulnerabilities, Control Deficiencies and Risk Conditions
- Identifying Internal and External Risk Factors
- Building IT Risk Scenarios
- Evaluating Scenarios for Completeness and Relevance
- Common Risk Scenario Errors
- Risk Assessment Concepts and Standards
- Qualitative, Semi-Quantitative and Quantitative Analysis
- Quantitative Methods: ALE, FAIR and Monte Carlo
- Risk Analysis Techniques: Bow-Tie, Fault Tree, Event Tree and Delphi
- Choosing a Consistent Assessment Methodology
- Translating Technical Events into Business Impact
- Business Impact Analysis for Risk Prioritisation
- Inherent and Residual Risk
- Evaluating Risk Against Business Objectives and Appetite
- Creating and Maintaining the IT Risk Register
- Using the Risk Register to Support Decisions
Vulnerabilities, Control Deficiencies and Risk Conditions
Where weaknesses hide
A vulnerability is a weakness a threat could exploit. Risk needs a threat, a vulnerability and an asset; a vulnerability no realistic threat can reach is low risk, but should be monitored as threats change.
Control deficiencies
Finding them
- Vulnerability scans and penetration tests.
- Audit findings and control testing.
- Incident and near-miss reviews.
- Control self-assessments and process walkthroughs.
- Supplier assurance reports.
Prioritising by risk
Example. A critical score on an isolated test server ranks below a high score on the internet-facing payment portal, because exposure and asset value make the portal’s risk far greater.
How the exam asks about it
| If the question asks… | The answer is usually… |
|---|---|
| BEST basis for prioritising vulnerabilities | Risk to the business, not score alone |
| Control exists but can’t achieve its objective | Design deficiency |
| Good control not performed | Operating deficiency |
| Vulnerability with no realistic threat | Low risk; monitor |
In short
- Vulnerabilities are weaknesses in technology, processes, people or facilities that a threat could exploit.
- Control deficiencies are missing controls, design deficiencies or operating deficiencies.
- Sources include scans, penetration tests, audits, incidents, control testing and self-assessments.
- Prioritise vulnerabilities by risk: exploitability, exposure, asset criticality and compensating controls, not severity score alone.
- A vulnerability with no realistic threat is low risk, but should be monitored as threats change.
Exam traps
- Treating every scanner finding as high risk because of its CVSS score.
- Looking only for technical vulnerabilities.
- Confusing a design deficiency (control can't work) with an operating deficiency (control not run).
- Ignoring vulnerabilities in third-party systems the organisation relies on.
Slides
Click the slide and use the arrow keys. F toggles full screen.
Where weaknesses hide
Control deficiencies
Prioritising by risk
ExampleA critical score on an isolated test server ranks below a high score on the internet-facing payment portal, because exposure and asset value make the portal's risk far greater.
1 / 8