Vulnerability

A vulnerability is a weakness in processes, technologies, and people of an organization that can be exploited by the threat actors or cybercriminals to gain unauthorized access to information and information systems. More specifically, it is a defect in a computer system, security procedures and protocols, security controls, design, and people that cybercriminals could exploit to violate security policies and stage further cyberattacks.

Vulnerability in combination with security threats create organizational risks. Both vulnerabilities and threats should exist in conjunction in order to pose imminent risks to information and information systems. If either of the two miss in the equation, they will remain threats or vulnerabilities without causing security risks to an organization. However, vulnerabilities may create threat events that may trigger risk events to organizational assets and should be dealt with proper vulnerability management measures before causing threats and risks to enterprises.

Nowadays, there are so many things that can cause vulnerabilities in information and information systems. The following are some of the causes of vulnerability:

• Poor credentials management
• Operating systems flaws
• Software bugs
• Design or architecture flaws
• Implementation flaws
• Improper input validation
• Inherent and negligent people’s weaknesses

Organizations can employ vulnerability assessment and management measures to proactively detect and report vulnerabilities in their information systems. There are various vulnerability scanning tools that enterprises can use to discover weaknesses in their systems.

The following are some of the common vulnerability scanning tools in use today:

• Burb Suite
• Nessus
• Nmap
• Nexpose
• OpenVAS
• Acunetix
• Metasploit
• Intruder
• QRadar
• Amazon Inspector
• Netsparker
• Abbey Scan
• Nexploit
• Nikto
• w3af