Vulnerability Analysis
Concepts and vocabulary
A vulnerability is a weakness; a threat is an actor or event that could exploit it; risk is the combination of likelihood and impact. Distinguish a vulnerability assessment (identify, classify, prioritize) from a penetration test (exploit and prove impact) - a scanner finding is not proof of exploitability.
Know the scoring and naming systems: CVE identifiers for individual vulnerabilities, NVD as the enriched database, CVSS for severity (base, temporal, environmental metrics; 0.0 none, 0.1–3.9 low, 4.0–6.9 medium, 7.0–8.9 high, 9.0–10.0 critical), CPE for platform naming, CCE for configuration items, and the SCAP family including OVAL and XCCDF. Recognize the methods: active (probe the host), passive (observe traffic), credentialed (authenticated, deeper, fewer false positives), and non-credentialed (external view only).
Process and tools
Typical lifecycle: define scope and assets → discover and inventory → scan → validate results → prioritize by risk → remediate → verify and rescan. Common tools: Nessus, Qualys, OpenVAS, Nikto (web servers), Nmap NSE scripts, Retina, Nexpose. Distinguish false positives (reported but not real) from false negatives (real but missed) - false negatives are usually the more dangerous outcome, and false positives are reduced by credential-based scanning and manual validation.
Traps
A CVSS 9.8 on an isolated test box may be lower business risk than a 6.5 on an internet-facing payment server; scoring is not prioritization by itself. A clean scan does not mean a clean system (zero-days, logic flaws, and missing credentials all hide findings). Scanning production aggressively can cause outages.
Worked example
A scanner flags an outdated Apache version as critical. Rule of thumb: verify before you report - banner grabbing or a version-specific request may show the vendor backported the patch without changing the banner, making this a false positive.