Closing information system vulnerabilities

As it relates to information security, a vulnerability is a weakness in a piece of technology (workstation, server, router, IOT, software, cloud, and so on), or a process (operational or management) that lessens the ability to provide assurance that the information system is secure.

In order to properly assess a vulnerability, three aspects of the vulnerability must be taken into account:

• Is the information system susceptible to a given flaw?
  • Millions of vulnerabilities exist. You must ascertain if your information system:
    • Meets the criteria where the vulnerability exists to include the specific version identified by the vendor
    • For example, version 1.01 of a piece of software may be vulnerable to an exploit, while version 1.02 is not

• Can an attacker access the information system in order to take advantage of the flaw?
  • Depending...