Your glossary for risk and compliance
Helpful definitions of all of the terms you need to know to better manage risk and compliance.
Terms
AFSL Authorised Representative AICPA Annex A Controls ASIC Attestation of Compliance (AOC) Business Continuity Management Compliance Automation Software Compliance Risk Management Cybersecurity Maturity Model Certification (CMMC) FedRAMP Governance Risk & Compliance (GRC) GPDR HIPAA HITRUST Incident Management Information Security Management System (ISMS) ISMS Governing Body ISO 27001 Notifiable Data Breach OAIC Policy Management SOC 1 SOC 2 SOC 3 SOC Reports SOC Trust Services Criteria (TSC) SSAE 16 SSAE 18 Third Party Risk Management Vendor Assessment Vendor Management Policy Vendor Review Vulnerability Vulnerability Management
What is a Vulnerability?
Mistakes happen, even in the process of building and coding technology. What’s left behind from these mistakes is commonly referred to as a bug. While bugs aren’t inherently harmful (except to the potential performance of the technology), many can be taken advantage of by nefarious actors—these are known as vulnerabilities. Vulnerabilities can be leveraged to force software to act in ways it’s not intended to, such as gleaning information about the current security defenses in place.
Once a bug is determined to be a vulnerability, it is registered by MITRE as a CVE, or common vulnerability or exposure, and assigned a Common Vulnerability Scoring System (CVSS) score to reflect the potential risk it could introduce to your organization. This central listing of CVEs serves as a reference point for vulnerability scanners.
Generally speaking, a vulnerability scanner will scan and compare your environment against a vulnerability database, or a list of known vulnerabilities; the more information the scanner has, the more accurate its performance. Once a team has a report of the vulnerabilities, developers can use penetration testing as a means to see where the weaknesses are, so the problem can be fixed and future mistakes can be avoided. When employing frequent and consistent scanning, you'll start to see common threads between the vulnerabilities for a better understanding of the full system.