Tools for identifying vulnerabilities
Many vulnerability assessment tools on the market focus specifically on finding vulnerabilities; however, a risk manager must be aware of all the tools and resources that could be leveraged as a source for vulnerabilities. The following are some resources that could be used by a risk manager to surface vulnerabilities:
- Vulnerability assessment scans: Vulnerability assessment tools such as Nessus and Qualys could be a good source of information for open vulnerabilities.
- Penetration tests: It is standard for organizations to perform a penetration test at least annually or after a major change in the underlying infrastructure and systems. The findings from the penetration test are a good source for identifying vulnerabilities.
- Static analysis: Issues flagged by the static analysis tools in a code pipeline are a good source for finding vulnerabilities. The majority of the issues that are flagged by these tools are related to logical...
