Understanding risks
The risk is assessed by identifying the vulnerabilities and threats, and then determining the likelihood and also the impact it brings.
A critical grade vulnerability in a web server has a higher risk in a public facing website than one in an internal website that is accessed only by the employees.
Even though the vulnerability might have a critical score, the associated risk varies depending on the organizations and the place it is deployed.
There are two important things to remember when assessing the risk:
- Determining the likelihood
- Defining the impact
Determining the likelihood
It is a probability that a threat will occur against a vulnerability. Let's look at a sample likelihood graph:
Severity | Description |
High | 75-100% chance that a vulnerability can be successfully exploited by a threat within a time frame of 1 year |
Moderate | 25-74% chance that a vulnerability can be successfully exploited by a threat within a time frame of 1 year |
Low | 0-24% chance that a vulnerability can be successfully... |
