Security Assessment and Risk Management
Security Assessment and Risk Management covers how you measure the state of security and decide what to do about the findings. Questions pair a finding with a business context and ask for the correct judgement or next step.
Assessment methods
- Document review and interviews - verify that policy exists and staff know it.
- Configuration baseline checks - compare hosts against a hardening standard.
- Vulnerability scanning - broad, automated, signature-based; produces false positives and can be noisy.
- Penetration testing - manual, goal-driven exploitation that proves impact; always requires written authorisation, a defined scope, rules of engagement and a rollback plan.
- Code audit - white-box review of source for flaw patterns.
- MLPS evaluation (等级测评) - formal third-party assessment against GB/T 22239-2019 control items, required periodically for higher-level systems.
Risk process
Assessment follows asset identification → threat identification → vulnerability identification → existing-control analysis → likelihood × impact → risk value → treatment. Treatment options are mitigate, transfer, avoid, accept, with acceptance reserved for management who own the consequence.
Worked example
A scanner reports CVSS 9.8 on an internet-facing server storing personal data, and 7.5 on an isolated laboratory machine with no data and no route to production. CVSS measures intrinsic technical severity; organisational risk also depends on asset value and exposure. The first finding is critical and needs emergency patching or compensating controls; the second may be documented and accepted with a re-test date. Reasoning shown: severity feeds risk, it does not replace it. Note also that scanners produce false positives, so findings must be verified, not blindly ticketed.
Traps
- Treating a vulnerability scan as a penetration test, or vice versa.
- Using the raw CVSS score as the final risk rating without asset context.
- Testing without written authorisation - unlawful regardless of intent.
- Skipping remediation verification and re-testing after fixes.
- Leaving risk acceptance undocumented or signed by someone without authority.