‫Vulnerability assessment is a process of defining, identifying and classifying the security holes in
‫its systems.
‫An attacker can exploit a vulnerability.
‫The name of a particular security hole to violate the security of a system now.
‫Some known vulnerability types are authentication, authorisation and input validation vulnerabilities.
‫And the main difference between the vulnerability assessment and the penetration test is that you do
‫not go beyond finding the vulnerabilities in a vulnerability assessment process.
‫You don't try to gain access or maintain the access you gained in all that.
‫So you won't be sure whether or not the finding really exists or very important if it's a false positive.
‫Now, you may find some explanations where vulnerability scanning and vulnerability assessment are used
‫for the same reason.
‫However, as you know, now, vulnerability assessment is a process that covers the vulnerability scanning,
‫a vulnerability assessment basically consists of the following steps.
‫Identify assets and build an asset inventory.
‫Do you know what the asset is?
‫No worries.
‫Just wait for the next slide.
‫Be patient, my young apprentice.
‫Categorize assets into groups, scan assets for known vulnerabilities.
‫Rank the risks.
‫Manage the remediation process.
‫And perform follow up remediation scans to be sure that they're gone.
‫There are tons of systems and services in an IT network.
‫You should scan all the hosts and services of your ID system.
‫Manual scan is, well, almost impossible in practice, so thankfully we have vulnerability scanners
‫or vulnerability assessment tools which help you to follow the other steps of the assessment.
‫Koalas, nurses and next policy are three of the most popular vulnerability scanners.
‫These are commercial tools, although they have a free community edition.
‫You will have to pay to use all of the functionalities of the tools.
‫Open Vass Open Vulnerability Assessment System is a free and open source tool supported by pretty good
‫community.