Risk Management for Cyber Security Managers - What Is Vulnerability Management?

The video tutorial explains the process of identifying, assessing, treating, and reporting security vulnerabilities. It distinguishes between vulnerabilities and risks, noting that vulnerabilities are security weaknesses while risks are the probability of these weaknesses being exploited. The tutorial provides an example using Adobe Reader to illustrate how vulnerabilities can be addressed. It also discusses methods for discovering vulnerabilities, including using third-party services and websites like nvd.nist.gov and CVD details.com. The video concludes with a mention of ethical hacking and penetration testing as ways to identify vulnerabilities.

What is the primary distinction between a vulnerability and a risk?

• Vulnerabilities are always evolving, while risks remain constant.

• Vulnerabilities are monitored, while risks are not.

• Vulnerabilities are security weaknesses, while risks are the likelihood of exploitation.

• Vulnerabilities are potential threats, while risks are actual attacks.

Why can't vulnerabilities be monitored like risks?

• Vulnerabilities are always visible.

• Vulnerabilities are too complex to monitor.

• Vulnerabilities are static and either exist or do not.

• Vulnerabilities change too frequently.

In the Adobe Reader example, how can the vulnerability be addressed?

• By uninstalling Adobe Reader.

• By reporting the vulnerability to the authorities.

• By updating to a newer version.

• By ignoring the vulnerability.

Which of the following is a method to discover vulnerabilities?

• Accessing third-party services and websites.

• Relying solely on antivirus software.

• Using outdated software.

• Ignoring security updates.

What are some popular websites mentioned for finding vulnerabilities?

• nvd.nist.gov and CVD details.com

• securitycheck.net and threatlist.com

• vulnerabilities.com and riskfinder.org

• hackersite.org and safetynet.com