Vulnerability and Control Deficiency

Vulnerabilities can arise from multiple sources, such as technological concerns, process lapses, and human weakness. To be effective, a vulnerability assessment must include process, procedural, and physical vulnerabilities in addition to technological flaws.

Audits, security reviews, vulnerability scans, and penetration tests are some methods that are commonly used to find vulnerabilities.

Various types of testing, as well as subject matter expert estimates, can be used to determine the degree of vulnerability. To the extent possible, the overall risk needs to be quantified. This helps management take relevant action.

Key Aspects from the CISM Exam Perspective

The following are some key aspects from the exam perspective:

Question	Possible Answer
What is the most cost-effective method of identifying new vulnerabilities for...