-: Identifying vulnerabilities.
So, we're gonna move down the chart
in the NIST 800-30, and go to identifying vulnerabilities
and predisposing conditions.
So, we talk about vulnerabilities.
We're gonna identify those threats.
We're also gonna look externally,
but now we have to look internally,
because vulnerabilities are internally focused, right?
So we're gonna identify the vulnerabilities
that focus on our internal factors,
and this focus is the match up those vulnerabilities
with the threats that we just considered in the last step.
So, always remember that if you have a threat
without a vulnerability, it's not a risk.
So again, if I have that hurricane in Kansas,
I'm not really worried about it, right?
I'm also not worried about a snow avalanche
in Miami, Florida, because it doesn't snow there, right?
Threats, such as hackers using a zero-day exploit
against a Windows XP system, that's a threat, right?
But, if my organization doesn't have
a Windows XP system in it, it's not a threat to me,
it's not a vulnerability for me, right?
If everything I have is Macintosh,
and people come out with a new Windows exploit,
I don't really care, right?
Because it doesn't apply to me.
But, if they come out with an IOS attack,
and I'm using a iPhone, I care, right?
Threat and vulnerability.
And so you have to consider these things
as you're going through and
identifying your vulnerabilities.
So, let's take another example.
If I have a threat such as hackers,
who haven't found an exploitable coding error
in my software, that's a threat, right?
The vulnerability, you have an unpatched operating system,
but nobody has found the bug in that operating system yet.
Right, the threat doesn't exist yet, therefore no risk.
You have to have a threat,
you have to have a vulnerability for there to be risk.
That's the whole idea here that we talk about.
So, if you have a threat without a vulnerability,
it is not a risk.
We talked about this, right?
So we have to consider that as we move forward.
That's the whole idea here with vulnerabilities,
you have to think of okay,
there's these threats out there, how do they apply to me?
And my organization?
If people are going out hacking database servers,
but you have no database servers,
it's not a vulnerability to you.
If you have a system that has holes in it,
but nobody knows how to exploit those holes yet,
it's not a vulnerability yet, right?
But you are going to have to put some encompassing
controls in place in case somebody does figure it out.
So this is the whole idea with identifying vulnerabilities.