Analyzing Vulnerabilities

Question 1

What is Vulnerability Confirmation?

Answer 1

Determining the accuracy of identified potential security weaknesses

Question 2

What is True Positive?

Answer 2

Real and exploitable vulnerability correctly identified

Question 3

What is False Positive?

Answer 3

Occurs when the system states that a vulnerability exists on the system, but that vulnerability actually doesn’t exist

Question 4

What is True Negative?

Answer 4

Correctly identifies the absence of a vulnerability

Question 5

What is False Negative?

Answer 5

Serious finding– vulnerability exists but remains undetected

Question 6

How are Vulnerabilites prioritized?

Answer 6

Factors include ease of exploitation, potential damage, system importance

Question 7

What is CVE (Common Vulnerabilities and Exposures)?

Answer 7

A public database that lists known software and hardware vulnerabilities in a standardized way to uniquely identify and reference them

Question 8

What is the EF (Exposure Factor)?

Answer 8

A quantifiable metric to estimate the percentage of asset damage

Question 9

What is RIsk Tolerance?

Answer 9

The level of risk an organization is willing to accept in pursuit of its objectives and before action is deemed necessary to mitigate the risk