CertiGuide to Security+  9  Chapter 5:  Operational/Organizational Security (Domain 5.0; 15%)       9  5.7  Risk Identification

5.7.3  Threat Identification 1 5.8  Education

NIST states, “Vulnerability analysis is an assessment to determine whether vulnerabilities identified during the evaluation of the construction and anticipated operation of the TOE (Target Of Evaluation) or by other methods (e.g. by flaw hypotheses) could allow users to violate the TSP (TOE Security Policy)”⁴⁶¹.

Vulnerabilities are weaknesses in the computer/network hardware or software used on the network, which can be taken advantage of.

These would include things like systems relying on inadequate or non-existent passwords, software bugs allowing for buffer overflow exploits, networks that can be “sniffed” for confidential data, etc. The previous chapters have gone into great detail as to types of vulnerabilities that exist, and why they exist, so we don’t have to repeat that information here.

5.7.3  Threat Identification 1 5.8  Education