Risk mitigation

Risk mitigation involves either fixing the vulnerability or providing some kind of control through which the likelihood or the impact of the flaw is taken care of.

For example, there is a high-level vulnerability in an OpenSSH server. The patching of software might take some time, so in order to mitigate the risk, the system administrator has only allowed the office IP to be able to connect via SSH to the servers.

A sample scan report

Now that we understand the basics of vulnerability, CVSS scores, and risks, we will take a sample vulnerability assessment report of one of the workstations and understand more about it. This scan has been performed by Nessus:

If we look at the previous screenshot, we can see...