A comprehensive study of an entire information system, seeking potential security weaknesses

 

Vulnerability assessments have many similarities with risk assessments. Assessments are usually carried out using the following steps

• Cataloging system assets and capabilities
• Assigning an order to cataloged resources based on value and importance
• Identifying  vulnerabilities or potential threats to each resource
• Mitigating or eliminating the most serious vulnerabilities for the most valuable resources