Jump to content

Vulnerability assessment

From Wikipedia, the free encyclopedia

This is an old revision of this page, as edited by Renewal6 (talk | contribs) at 09:46, 11 January 2024 (Reverting edit(s) by Johniep (talk) to rev. 1170038093 by OAbot: Addition of unnecessary/inappropriate external links (RW 16.1)). The present address (URL) is a permanent link to this revision, which may differ significantly from the current revision.

A vulnerability assessment is the process of identifying, quantifying, and prioritizing (or ranking) the vulnerabilities in a system. Examples of systems for which vulnerability assessments are performed include, but are not limited to, information technology systems, energy supply systems, water supply systems, transportation systems, and communication systems. Such assessments may be conducted on behalf of a range of different organizations, from small businesses up to large regional infrastructures. Vulnerability from the perspective of disaster management means assessing the threats from potential hazards to the population and to infrastructure. It may be conducted in the political, social, economic or environmental fields.

Vulnerability assessment has many things in common with risk assessment. Assessments are typically performed according to the following steps:

  1. Cataloging assets and capabilities (resources) in a system.
  2. Assigning quantifiable value (or at least rank order) and importance to those resources
  3. Identifying the vulnerabilities or potential threats to each resource
  4. Mitigating or eliminating the most serious vulnerabilities for the most valuable resources

"Classical risk analysis is principally concerned with investigating the risks surrounding a plant (or some other object), its design and operations. Such analysis tends to focus on causes and the direct consequences for the studied object. Vulnerability analysis, on the other hand, focuses both on consequences for the object itself and on primary and secondary consequences for the surrounding environment. It also concerns itself with the possibilities of reducing such consequences and of improving the capacity to manage future incidents." (Lövkvist-Andersen, et al., 2004)[1] In general, a vulnerability analysis serves to "categorize key assets and drive the risk management process." (United States Department of Energy, 2002).[2]

In the United States, guides providing valuable considerations and templates for completing a vulnerability assessment are available from numerous agencies including the Department of Energy, the Environmental Protection Agency, and the United States Department of Transportation.

Several academic research papers including Turner et al. (2003),[3] Ford and Smith (2004),[4] Adger (2006),[5] Fraser (2007)[6] and Patt et al. (2010)[7] amongst others, have provided a detail review of the diverse epistemologies and methodologies in vulnerability research. Turner et al. (2003)[3] for example proposed a framework that illustrates the complexity and interactions involved in vulnerability analysis, draws attention to the array of factors and linkages that potentially affects the vulnerability of a couple of human–environment systems. The framework makes use of nested flowcharts to show how social and environmental forces interact to create situations vulnerable to sudden changes. Ford and Smith (2004), propose an analytical framework, based on research with Canadian arctic communities. They suggest that, the first stage is to assess current vulnerability by documenting exposures and current adaptive strategies. This should be followed by a second stage that estimates directional changes in those current risk factors and characterizes the community's future adaptive capacity. Ford and Smith's (2004) framework utilizes historic information including how communities have experienced and addressed climatic hazards, with information on what conditions are likely to change, and what constraints and opportunities there are for future adaptation.

Standardized Government Vulnerability Assessment Services

The GSA (also known as the General Services Administration) has standardized the “Risk and Vulnerability Assessments (RVA)” service as a pre-vetted support service, to rapidly conduct assessments of threats and vulnerabilities, determine deviations from acceptable configurations, enterprise or local policy, assess the level of risk, and develop and/or recommends appropriate mitigation countermeasures in operational and non-operational situations. This standardized service offers the following pre-vetted support services:

  • Network Mapping
  • Vulnerability Scanning
  • Phishing Assessment
  • Wireless Assessment
  • Web Application Assessment
  • Operating System Security Assessment (OSSA)
  • Database Assessment
  • Penetration Testing

These services are commonly referred to as Highly Adaptive Cybersecurity Services (HACS) and are listed at the US GSA Advantage website.[8]

This effort has identified key service providers which have been technically reviewed and vetted to provide these advanced services. This GSA service is intended to improve the rapid ordering and deployment of these services, reduce US government contract duplication, and to protect and support the US infrastructure in a more timely and efficient manner.

132-45D Risk and Vulnerability Assessment [9] identifies, quantifies, and prioritizes the risks and vulnerabilities in a system. A risk assessment identifies recognized threats and threat actors and the probability that these factors will result in exposure or loss.

Vulnerability to Climate Change

Section 'Assessments' not found

See also


References

  1. Handbook of International Electrical Safety Practices
  1. ^ Lövkvist-Andersen, et al., 2004 https://www.researchgate.net/publication/242256695_Modelling_Society's_Capacity_to_Manage_Extraordinary_Events_Developing_a_Generic_Design_Basis_GDB_Model_for_Extraordinary_Societal_Events_using_Computer-Aided_Morphological_Analysis
  2. ^ US Department of Energy. (2002). Vulnerability Assessment Methodology, Electric Power Infrastructure. [1]
  3. ^ a b Turner, B. L.; Kasperson, R. E.; Matson, P. A.; McCarthy, J. J.; Corell, R. W.; Christensen, L.; Eckley, N.; Kasperson, J. X.; Luers, A.; Martello, M. L.; Polsky, C.; Pulsipher, A.; Schiller, A. (5 June 2003). "Science and Technology for Sustainable Development Special Feature: A framework for vulnerability analysis in sustainability science". Proceedings of the National Academy of Sciences. 100 (14): 8074–8079. Bibcode:2003PNAS..100.8074T. doi:10.1073/pnas.1231335100. PMC 166184. PMID 12792023.
  4. ^ Ford, James D.; Barry Smit (Dec 2004). "A Framework for Assessing the Vulnerability of Communities in the Canadian Arctic to Risks Associated with Climate Change". Arctic. 57 (4): 389–400. doi:10.14430/arctic516. hdl:10535/3095. JSTOR 40512642.
  5. ^ Adger, W. Neil (August 2006). "Vulnerability". Global Environmental Change. 16 (3): 268–281. doi:10.1016/j.gloenvcha.2006.02.006.
  6. ^ Fraser, Evan D. G. (August 2008). "Travelling in antique lands: using past famines to develop an adaptability/resilience framework to identify food systems vulnerable to climate change". Climatic Change. 83 (4): 495–514. doi:10.1007/s10584-007-9240-9. S2CID 154404797.
  7. ^ Patt, Anthony; Dagmar Schröter; Richard Klein; Anne Cristina de la Vega-Leinert (2010). Assessing vulnerability to global environmental change : making research useful for adaptation decision making and policy (1st paperback ed.). London: Earthscan. ISBN 9781849711548.
  8. ^ "132-45D Risk and Vulnerability Assessment Companies". 20 March 2018.
  9. ^ "132-45D Risk and Vulnerability Assessment". 20 March 2018.
Retrieved from "https://en.wikipedia.org/w/index.php?title=Vulnerability_assessment&oldid=1194904541"