Identify Dimensions of Vulnerability

Those working in IT have a tendency to make judgements from a technology perspective. Often, though, it is not the technology itself that is at issue, but rather how the technology is managed, or human factors affecting the use of technology. To understand a vulnerability, the assessment process needs to determine what is putting a component at risk.

People, technology, processes, vendors , legislation, business partners , infrastructure systems, facilities, the environment, financials, and social and organizational considerations, can all be viewed as vulnerabilities. The point is to determine the most likely threats relating to the company s defined vulnerabilities. Vulnerabilities are established based on past experiences, the nature of the business, the competition, the physical location, the extent to which the business relies on technology, geographical and political considerations, and so forth.