4Vulnerability Assessment and Risk Management

• 4.1Vulnerability management

  Covers vulnerability management, the continuous cycle of finding and fixing weaknesses (identify -> manage -> mitigate); the difference between active reconnaissance (touching the target directly) and passive reconnaissance (using only public information and observation); and port scanning to list open ports plus automation for repetitive work—as the foundation for working out "where the holes are and how to close them."

• 4.2Threat intelligence

  Covers CVE, which references known weaknesses by a common name, and CVSS, which scores their severity; the uses and limits of a vulnerability database that collects weaknesses; and information sources such as security reports, news, subscription services, and crowdsourced intelligence—the basics of gathering and using them to judge "which threats deserve attention right now."

• 4.3Risk management

  Covers the difference between a vulnerability (the weakness itself) and risk (measured as likelihood times impact); the idea of ranking risk into low/medium/high/critical; choosing among the four risk responses—accept, reduce, transfer, avoid; and the relationship whereby a higher data classification brings greater risk—learned as the judgment of deciding "what to protect, and how far."

• 4.4Disaster recovery and business continuity

  Covers the difference between a DRP (disaster recovery plan), focused on procedures to restore IT systems, and a BCP (business continuity plan), the broader plan to keep the whole business running; RTO (how fast to recover) and RPO (how much data loss is tolerable); the role of backups; and the three kinds of DR controls—detective, preventive, and corrective—as the foundation for designing "how to recover after a stoppage."