Vulnerability assessment
Encyclopedia
A vulnerability assessment is the process of identifying, quantifying, and prioritizing (or ranking) the vulnerabilities
in a system. Examples of systems for which vulnerability assessments are performed include, but are not limited to, information technology
systems, energy supply
systems, water supply
systems, transportation systems, and communication
systems. Such assessments may be conducted on behalf of a range of different organisations, from small businesses up to large regional infrastructures. Vulnerability from the perspective of disaster management means assessing the threats from potential hazards to the population and to infrastructure.
It may be conducted in the political, social, economic or environmental fields.
Vulnerability assessment has many things in common with risk assessment
. Assessments are typically performed according to the following steps:
"Classical risk analysis
is principally concerned with investigating the risks surrounding a plant (or some other object), its design and operations. Such analyses tend to focus on causes and the direct consequences for the studied object. Vulnerability analyses, on the other hand, focus both on consequences for the object itself and on primary and secondary consequences for the surrounding environment. It also concerns itself with the possibilities of reducing such consequences and of improving the capacity to manage future incidents." (Lövkvist-Andersen, et al., 2004) In general, a vulnerability analysis serves to "categorize key assets and drive the risk management process." (United States Department of Energy, 2002)1
In the United States, guides providing valuable considerations and templates for completing a vulnerability assessment are available from numerous agencies including the Department of Energy, the Environmental Protection Agency, and the United States Department of Transportation, just to name a few.
Vulnerability
Vulnerability refer to the susceptibility of a person, group, society, sex or system to physical or emotional injury or attack. The term can also refer to a person who lets their guard down, leaving themselves open to censure or criticism...
in a system. Examples of systems for which vulnerability assessments are performed include, but are not limited to, information technology
Information technology
Information technology is the acquisition, processing, storage and dissemination of vocal, pictorial, textual and numerical information by a microelectronics-based combination of computing and telecommunications...
systems, energy supply
Energy supply
Energy supply is the delivery of fuels or transformed fuels to point of consumption. It potentially encompasses the extraction, transmission, generation, distribution and storage of fuels...
systems, water supply
Water supply
Water supply is the provision of water by public utilities, commercial organisations, community endeavours or by individuals, usually via a system of pumps and pipes...
systems, transportation systems, and communication
Communication
Communication is the activity of conveying meaningful information. Communication requires a sender, a message, and an intended recipient, although the receiver need not be present or aware of the sender's intent to communicate at the time of communication; thus communication can occur across vast...
systems. Such assessments may be conducted on behalf of a range of different organisations, from small businesses up to large regional infrastructures. Vulnerability from the perspective of disaster management means assessing the threats from potential hazards to the population and to infrastructure.
It may be conducted in the political, social, economic or environmental fields.
Vulnerability assessment has many things in common with risk assessment
Risk assessment
Risk assessment is a step in a risk management procedure. Risk assessment is the determination of quantitative or qualitative value of risk related to a concrete situation and a recognized threat...
. Assessments are typically performed according to the following steps:
- Cataloging assets and capabilities (resources) in a system.
- Assigning quantifiable value (or at least rank order) and importance to those resources
- Identifying the vulnerabilities or potential threats to each resource
- Mitigating or eliminating the most serious vulnerabilities for the most valuable resources
"Classical risk analysis
Risk analysis (engineering)
Risk analysis is the science of risks and their probability and evaluation.Probabilistic risk assessment is one analysis strategy usually employed in science and engineering.-Risk analysis and the risk workshop:...
is principally concerned with investigating the risks surrounding a plant (or some other object), its design and operations. Such analyses tend to focus on causes and the direct consequences for the studied object. Vulnerability analyses, on the other hand, focus both on consequences for the object itself and on primary and secondary consequences for the surrounding environment. It also concerns itself with the possibilities of reducing such consequences and of improving the capacity to manage future incidents." (Lövkvist-Andersen, et al., 2004) In general, a vulnerability analysis serves to "categorize key assets and drive the risk management process." (United States Department of Energy, 2002)1
In the United States, guides providing valuable considerations and templates for completing a vulnerability assessment are available from numerous agencies including the Department of Energy, the Environmental Protection Agency, and the United States Department of Transportation, just to name a few.