Vulnerability Management and Risk Assessment
Vulnerability Management and Risk Assessment tests whether you can find weaknesses, score them honestly, and justify treatment in business terms. It rewards people who know that severity is not priority.
Core rules
- Authenticated (credentialed) scans see installed packages and registry configuration; unauthenticated scans only see what is exposed on the network. Comparing the two quickly shows coverage gaps.
- False positive: reported but nonexistent. False negative: real but unreported, and the more dangerous of the two.
- CVSS v3.1 base metrics: Attack Vector, Attack Complexity, Privileges Required, User Interaction, Scope, Confidentiality, Integrity, Availability. Temporal and Environmental scores adjust for exploit maturity and local context.
- Prioritise with context: CVSS plus EPSS probability plus CISA KEV listing plus asset criticality plus exposure. A 9.8 on an isolated lab host can rank below a 7.5 on an internet-facing payment server.
- Risk treatment options: mitigate, transfer, avoid, accept. Acceptance is a documented decision with an owner and an expiry, not silence.
- Quantitative basics: SLE = Asset Value x Exposure Factor; ALE = SLE x Annualised Rate of Occurrence.
Worked example
Asset value is $200,000, exposure factor 0.25, so SLE = $50,000. The event is expected 0.4 times a year, so ALE = $20,000. A control costs $8,000 per year and reduces the ARO to 0.1, giving a residual ALE of $5,000 and an annual benefit of $15,000 against $8,000 of cost. Net benefit is $7,000, so the control is justified on quantitative grounds and the residual risk is recorded with an owner.
Traps that cost marks
- Assuming the highest CVSS score is automatically the first ticket.
- Scanning without credentials and declaring the estate clean.
- Mixing up SLE and ALE in the arithmetic.
- Reporting a vulnerability count as a risk statement without asset context.