Re: Vulnerability vs. Risk Assessments

[Valdis Kletnieks <Valdis.Kletnieks () VT EDU>]

On Wed, 04 Nov 2009 19:03:01 MST, Chris Kidd said:
> I'm having a hard time articulating the difference between these two types
> of assessments, so I'm hoping someone can clearly define them.

It's pretty clear the difference between a vulnerability assessment and a
risk assessment, once you get vulnerability and risk straight.

Vulnerability: Can some miscreant find a way to do XYZ to you?

Risk: How many miscreants are likely to *actually* do so, and how screwed are
you if it happens?

A system can be both highly vulnerable (for instance, a stand-alone kiosk with
known buggy software that is known to crash if somebody hits the shift and
control keys at the same time), but be low-risk (power cycle the kiosk and
reboot from the read-only CD, no major loss suffered).

A system can be not very vulnerable (a heavily firewalled and hardened
server in a high-security area) but still be high-risk (if that sensitive
data escapes, we *will* suffer $10M in damage and losses).

That help?

Attachment: _bin
Description: