Vulnerability Assessment and Risk Management

What this chapter covers

This chapter is about finding weaknesses, judging how much they matter, and planning for the worst.

It starts with scanning and reconnaissance, then looks at where information about threats comes from. It then turns to risk, which is how security teams decide what to fix first, and ends with disaster recovery and business continuity.

The pages are written for beginners, and each term is explained in plain language.

How the topics fit together

The chapter follows the path from finding a problem to being ready for a disaster.

The pages connect like this:

• Vulnerability management is the repeating cycle of finding and fixing weaknesses, using reconnaissance and scanning.
• Threat intelligence supplies context, such as CVE numbers and reports, and explains how to share information safely.
• Risk management turns findings into a ranked list and picks a response to each risk.
• Disaster recovery and business continuity prepare for the cases where prevention fails.

How to use these pages

Each topic page has the same five sections, so you can skim for what you need.

• What it is: the idea in plain words.
• How it works: the mechanism, with diagrams and tables.
• What to remember for the exam: the facts to memorise.
• Common mistakes: the classic traps.
• Check yourself: three questions with short answers.

Several ideas have short names that are easy to confuse, such as RTO and RPO, or preventive, detective and corrective controls. Make your own flash cards for these and test yourself.

If you want practice, look up a recent CVE entry and read its score, or draw a likelihood and impact grid for three risks in your own home or workplace. Only run scans on systems you own or have permission to test.