Vulnerability assessment

Workshop 1.5: assess the vulnerabilities of supporting assets, business value by business value.

Add-on page

This page only appears if the "Vulnerability assessment" add-on is ticked in 1.1 Study context. The add-on also governs page 1.6 and the likelihood columns of the following workshops. It is active by default — earlier studies lose nothing.

Principle

You start from a business value, drill down to the supporting assets it depends on (via the workshop 1 dependency matrix), and score the vulnerabilities of each.

The page distinguishes direct dependency from indirect dependency: a business value can be exposed by a supporting asset it does not use directly.

Scoring a vulnerability

Each supporting asset must first be given a type from the library — it is this type that determines the applicable vulnerabilities. Until a type is chosen, no vulnerability is shown.

Column	Content
ID, Vulnerability	Canonical vulnerability from the library
Criterion	Security criterion concerned
Control level	Score — clicking the current level again resets it
Measures / Justification	Measures in place, justification

Counters display the breakdown: Critical, High, Moderate, Controlled, Not assessed, and a risk percentage per supporting asset.

Resetting

Clicking the already-selected level again clears it. The Reset this supporting asset button clears all its assessments, after a confirmation naming the asset.

What this page feeds

• The security framework (1.4) — automatic pre-filling of scores via the links in 1.6.
• The likelihood columns of workshops 3 and 4.
• The {TABLE-VULNERABILITES} block of the Word report, only emitted if the add-on is active.