{"licence":{"name":"CC BY-SA 4.0","spdx":"CC-BY-SA-4.0","url":"https://creativecommons.org/licenses/by-sa/4.0/","attribution":"Atlas, a bilingual technical dictionary (https://cmaintz.github.io/tech-atlas/)"},"id":"security/vulnerability-assessment","url":{"en":"https://cmaintz.github.io/tech-atlas/en/terms/security/vulnerability-assessment/","da":"https://cmaintz.github.io/tech-atlas/da/terms/security/vulnerability-assessment/"},"term":{"en":"Vulnerability assessment","da":"Sårbarhedsvurdering"},"aka":{"en":[],"da":["vulnerability assessment"]},"domain":["security"],"cluster":"controls","layer":"governance","status":"current","summary":{"en":"A review of systems to find their weaknesses and rank which ones matter most to fix first.","da":"En gennemgang af systemer for at finde deres svagheder og prioritere, hvilke der er vigtigst at rette først."},"body":{"formal":{"en":"A structured review that gathers weaknesses - from scans, settings and interviews - and rates each by how likely it is to be used and how much harm it could do to the organisation's assets, giving a ranked list for action.","da":"En struktureret gennemgang, der samler svagheder - fra scanninger, indstillinger og interviews - og vurderer hver efter, hvor sandsynligt det er, at den udnyttes, og hvor stor skade den kan gøre på virksomhedens aktiver, så man får en prioriteret handlingsliste."},"plain":{"en":"Like a surveyor's report on a house - it lists every crack and leak, then tells you which ones will bring the roof down and which can wait.","da":"Som en tilstandsrapport på et hus - den nævner alle revner og utætheder og fortæller derefter, hvilke der kan få taget til at falde ned, og hvilke der kan vente."},"inPractice":{"en":"A scan at a regional hospital finds 400 issues; the IT security team's assessment shows that only 12 sit on systems holding patient data that can be reached from the internet, and those go to the top of the list.","da":"En scanning på et regionshospital finder 400 fund; IT-sikkerhedsteamets vurdering viser, at kun 12 sidder på systemer med patientdata, som kan nås fra internettet, og de kommer øverst på listen."},"whyItMatters":{"en":"No team can fix everything at once; ranking weaknesses by real risk makes sure limited time goes where it prevents the most harm.","da":"Intet team kan rette alt på én gang; at prioritere svagheder efter reel risiko sikrer, at den begrænsede tid bruges dér, hvor den forhindrer mest skade."}},"deepDive":{"en":"A vulnerability assessment turns raw findings into risk-ranked decisions. NIST SP 800-115 groups the underlying techniques into review techniques (documentation, log and rule-set review, configuration review), target identification and analysis (discovery, port and service identification, vulnerability scanning) and target vulnerability validation (password cracking, penetration testing). An assessment draws mainly on the first two and validates selectively; a penetration test concentrates on the third. Inputs include authenticated and unauthenticated scan results, configuration baselines, architecture diagrams, interviews with system owners and the asset inventory, which supplies the business context no scanner has.\n\nPrioritisation is where the work lies. A CVSS base score describes the intrinsic severity of a flaw under worst-case assumptions; CVSS v4.0 (FIRST, 2023) separates base, threat, environmental and supplemental metrics precisely because the base score alone is a poor proxy for risk. Modern programmes therefore combine several signals: exploitation evidence (CISA's Known Exploited Vulnerabilities catalogue), exploitation probability (FIRST's EPSS, a daily-updated estimate of the likelihood of exploitation within 30 days), exposure (internet-facing or internal, reachable from user networks or only from an admin segment), compensating controls, and asset criticality - what data and business functions depend on the system. Decision frameworks such as CISA's Stakeholder-Specific Vulnerability Categorization (SSVC) encode this as a decision tree with outcomes Track, Track*, Attend and Act, replacing a single numeric threshold.\n\nValidation removes false positives before remediation effort is spent: a version-based finding may be moot because a backported fix is installed, the vulnerable module is not loaded, or the feature is disabled. Conversely, absence of findings is not proof of absence - unscanned assets, missing credentials and custom applications all produce silent gaps, which is why coverage must be reported alongside findings.\n\nThe output is a remediation plan with owners and deadlines, plus explicit risk decisions for items that cannot be fixed in time: mitigation (segmentation, virtual patching, configuration change) or formal acceptance with an owner and an expiry date. This connects the assessment to the organisation's risk management: ISO/IEC 27002:2022 control 8.8 (management of technical vulnerabilities) requires obtaining information about vulnerabilities, evaluating exposure and taking appropriate measures, and NIS2 Art. 21(2)(e) names vulnerability handling and disclosure among the mandatory measures. Assessments recur, because every new CVE, deployment and configuration change alters the picture; a one-off assessment is a snapshot of a moving target.","da":"En sårbarhedsvurdering omsætter rå fund til risikoprioriterede beslutninger. NIST SP 800-115 grupperer de underliggende teknikker i gennemgangsteknikker (gennemgang af dokumentation, logs, regelsæt og konfiguration), identifikation og analyse af mål (opdagelse, identifikation af porte og tjenester, sårbarhedsscanning) og validering af sårbarheder (adgangskodeknækning, penetrationstest). En vurdering trækker primært på de to første og validerer udvalgte fund; en penetrationstest koncentrerer sig om den tredje. Input omfatter autentificerede og uautentificerede scanningsresultater, konfigurationsbaselines, arkitekturdiagrammer, interviews med systemejere og aktivfortegnelsen, som leverer den forretningskontekst, ingen scanner har.\n\nPrioriteringen er dér, arbejdet ligger. En CVSS-basisscore beskriver en fejls iboende alvor under værst tænkelige antagelser; CVSS v4.0 (FIRST, 2023) adskiller base-, threat-, environmental- og supplemental-metrikker, netop fordi basisscoren alene er en dårlig målestok for risiko. Moderne programmer kombinerer derfor flere signaler: bevis for udnyttelse (CISA's katalog over Known Exploited Vulnerabilities), sandsynlighed for udnyttelse (FIRST's EPSS, et dagligt opdateret estimat af sandsynligheden for udnyttelse inden for 30 dage), eksponering (mod internettet eller internt, nåbar fra brugernetværk eller kun fra et administrationssegment), kompenserende kontroller og aktivets kritikalitet - hvilke data og forretningsfunktioner der afhænger af systemet. Beslutningsrammer som CISA's Stakeholder-Specific Vulnerability Categorization (SSVC) udtrykker dette som et beslutningstræ med udfaldene Track, Track*, Attend og Act i stedet for én numerisk tærskel.\n\nValidering fjerner falske positiver, før der bruges kræfter på afhjælpning: et versionsbaseret fund kan være irrelevant, fordi en backportet rettelse er installeret, det sårbare modul ikke er indlæst, eller funktionen er slået fra. Omvendt er fravær af fund ikke bevis for fravær - uscannede aktiver, manglende legitimationsoplysninger og specialudviklede applikationer giver alle tavse huller, og derfor skal dækningen rapporteres sammen med fundene.\n\nResultatet er en afhjælpningsplan med ejere og frister samt eksplicitte risikobeslutninger for det, der ikke kan rettes i tide: afbødning (segmentering, virtuel patching, konfigurationsændring) eller formel risikoaccept med ejer og udløbsdato. Dermed kobles vurderingen til organisationens risikostyring: ISO/IEC 27002:2022 kontrol 8.8 (håndtering af tekniske sårbarheder) kræver, at man indhenter oplysninger om sårbarheder, vurderer eksponeringen og træffer passende foranstaltninger, og NIS2 art. 21, stk. 2, litra e, nævner håndtering og offentliggørelse af sårbarheder blandt de obligatoriske foranstaltninger. Vurderinger gentages, fordi hver ny CVE, udrulning og konfigurationsændring ændrer billedet; en enkeltstående vurdering er et øjebliksbillede af et bevægeligt mål."},"edges":[{"type":"requires","to":"security/vulnerability","confidence":"high","strength":"normal"},{"type":"requires","to":"security/risk","confidence":"high","strength":"normal"},{"type":"requires","to":"security/asset-inventory","confidence":"high","strength":"normal"},{"type":"requires","to":"security/cve","confidence":"high","strength":"normal"},{"type":"kind-of","to":"security/control","confidence":"high","strength":"normal"}],"depth":4,"sources":[{"title":"Cyber Security Fast Track - Ordliste","tier":"course-material"},{"title":"NIST SP 800-115 - Technical Guide to Information Security Testing and Assessment","tier":"standard","publisher":"NIST"}],"draft":true}