Vulnerabilities are just a fact of life in information technology.
In fact, in an upcoming video, I'm going to go ahead and classify the different types of vulnerabilities.
That's something that is very important for us to do.
And one of the reasons we want to do that is because of the fact that these vulnerabilities are so common.
You know, they're everywhere.
So we need to categorize them and then work to guard against them being exploited.
I'm getting ahead of myself, though.
What is a vulnerability?
Well, it's any weakness that can be exploited.
As you're going to see, we're going to classify these.
So we might be talking about some vulnerability that exist in the system because of a misconfiguration
doe.
So that's a problem.
But maybe it's a software bug.
Maybe it's a hardware bug.
We are going to want to obtain full, complete lists of vulnerabilities.
We want to know about the vulnerability before the computer criminal does, if at all possible.
Now, when we learn about vulnerabilities, what we need to be doing is analyzing them and thinking
about risks.
By the way, this often has to do this analysis with the value or the sensitivity of the information
that we're dealing with.
Right.
So it's that balancing act.
You've got to go, geez, is this even important data?
Oh, okay.
It is important data.
Oh, there's a vulnerability that could make this data be accessed.
What are the chances what are the real chances that someone would do that?
So these are all of the types of questions you need to be ready to ask yourself.
Now, the next thing I want to discuss with you is the simple fact that assessment reports are going
to be a huge part of what we deal with now in cybersecurity.
You want vulnerability assessments performed against your hardware and software, and in fact, you
may be the one performing the assessment, the vulnerability assessment testing.
Yeah.
It may be your job to produce these reports.
There are four styles of reports I want you to be familiar with.
You can create vulnerability assessment reports that are what we call product based.
These are typically private, completely private.
So you have some router.
You have this software that is going to stay within the confines of your organization and is going to
privately on a private network.
It's going to test that router for vulnerabilities.
This is very different from a service based type of vulnerability assessment report creation in the
service based approach.
You're working with a third party.
And what's probably happening is the data is being sent outside of your private network and your private
organization.
There is a tree based assessment report approach in the tree based.
You're providing a ton of information upfront and then the system will test for vulnerabilities.
And finally, there's the coolest name, the inference based type of assessment, report generation
process.
And with the inference based, the software that's doing the vulnerability assessment will actually
be mapping out the addresses and the ports.
And so it will be going in and it will be discovering what needs to be vulnerability assessment test.
How cool.
So we're getting a lot out of that software approach to assessment reports.
All right.
Well, we've got lots more to say about vulnerabilities.
So I want you to I want to thank you for watching this.
Look at the basic concepts.
But more is on the way.