The objective of a vulnerability assessment is to examine systems for weaknesses that could be exploited, and to determine the chances of someone attacking any of those weaknesses. Numerous types of vulnerabilities, both physical and electronic, are possible. If the report card indicates that any management controls are rated as poor, or very poor, then immediate management actions are recommended to develop plans to implement new system controls. A rating of good or fair would indicate a less aggressive need to add controls probably as part of the following years project plans.
Many tools exist for evaluating electronic vulnerabilities.
This prevents the laborious task of examining systems manually and researching the latest exploits. It also provides a method of easily obtaining consistent data on system vulnerabilities. Although Internet Scanner is confined to the electronic environment, be sure to examine exploits that could occur with physical access as well as electronically. Finally for completeness, examine scripts and applications on systems for potential vulnerabilities. This ensures that all vectors for attack are included in the assessment, so that efforts at reducing risk are based on real threats, not just those that are technical or well advertised.