The next step in risk assessment is vulnerability assessment.
This is where we want to find are there any weaknesses or gaps in our
information systems that could be exploited by a threat.
Are there gaps or breakdowns in our system security procedures,
a lack of internal controls, or poorly configured or implemented system?
All of these weaknesses are the things that become the point of
opportunity for the threat source or a threat actor.
So with vulnerability assessment, we really want to understand ourselves.
We want to discover any potential points of compromise of our IT systems,
and this can be done either through an internal or external review.
We know that the statistics show that most IT system compromises would
have been prevented if the organization had identified and fixed
vulnerabilities that were already known and documented.
So an important thing here is that most cases when a system is compromised,
it's not because of a new ingenious type of attack,
it's because there were things that we should have done that
were already well known that hadn't been done.
Some of the places we can find out about known vulnerabilities
are the common vulnerability scoring system,
the common weakness and enumeration lists,
the CIS controls, the critical security controls,
and the use of standards such as the payment card industry,
PCI DSS,
which has a list of excellent types of steps we can take to secure our systems.
A vulnerability assessment is like the actions of a
general that is going to defend the city.
The first thing the general would do is review their defenses.
Yeah. Are the controls or the guards awake?
Are they alert?
Are there enough of them?
Then,
they look at the city or the target from the
perspective of a potential attacker.
If I wanted to break in, how would I do it?
And this is something that we should do from an IT perspective as well.
Take a look at what security controls we have,
but also put ourselves in the position of a hacker who's
trying to feed their family and say how would they try to get
in if they were desperate to do so?
In this way,
we understand the motivation and mind of the attacker so
hopefully we become better at defending as well.
And that, of course, is threat modeling at its best.