View source for Vulnerability assessment

A '''vulnerability assessment''' is the process of identifying, quantifying, and prioritizing (or ranking) the vulnerabilities in a system.  Examples of systems for which vulnerability assessments are performed include, but are not limited to, [[Engineering:Information technology|information technology]] systems, energy supply systems, water supply systems, transportation systems, and [[Biology:Communication|communication]] systems.  Such assessments may be conducted on behalf of a range of different organizations, from small businesses up to large regional infrastructures. Vulnerability from the perspective of disaster management means assessing the threats from potential hazards to the population and to infrastructure.
It may be conducted in the political, social, economic or environmental fields.

Vulnerability assessment has many things in common with [[Risk assessment|risk assessment]].  Assessments are typically performed according to the following steps:

# Cataloging assets and capabilities (resources) in a system.
# Assigning quantifiable value (or at least rank order) and importance to those resources
# Identifying the vulnerabilities or potential threats to each resource
# Mitigating or eliminating the most serious vulnerabilities for the most valuable resources

"Classical [[Engineering:Risk analysis (engineering)|risk analysis]] is principally concerned with investigating the risks surrounding a plant (or some other object), its design and operations.  Such analysis tends to focus on causes and the direct consequences for the studied object. Vulnerability analysis, on the other hand, focuses both on consequences for the object itself and on primary and secondary consequences for the surrounding environment.  It also concerns itself with the possibilities of reducing such consequences and of improving the capacity to manage future incidents." (Lövkvist-Andersen, ''et al.'', 2004)<ref>Lövkvist-Andersen, ''et al.'', 2004 https://www.researchgate.net/publication/242256695_Modelling_Society's_Capacity_to_Manage_Extraordinary_Events_Developing_a_Generic_Design_Basis_GDB_Model_for_Extraordinary_Societal_Events_using_Computer-Aided_Morphological_Analysis</ref>  In general, a vulnerability analysis serves to "categorize key assets and drive the risk management process." (United States Department of Energy, 2002).<ref>US Department of Energy. (2002). Vulnerability Assessment Methodology, Electric Power Infrastructure. [http://www.esisac.com/publicdocs/assessment_methods/VA.pdf]</ref>

In the United States, guides providing valuable considerations and templates for completing a vulnerability assessment are available from numerous agencies including the Department of Energy, the Environmental Protection Agency, and the United States Department of Transportation.

Several academic research papers including Turner et al. (2003),<ref name=Turner>{{cite journal|last=Turner|first=B. L. |author2=Kasperson, R. E. |author3=Matson, P. A. |author4=McCarthy, J. J. |author5=Corell, R. W. |author6=Christensen, L. |author7=Eckley, N. |author8=Kasperson, J. X. |author9=Luers, A. |author10=Martello, M. L. |author11=Polsky, C. |author12=Pulsipher, A. |author13=Schiller, A.|title=Science and Technology for Sustainable Development Special Feature: A framework for vulnerability analysis in sustainability science|journal=Proceedings of the National Academy of Sciences|date=5 June 2003|volume=100|issue=14|pages=8074–8079|doi=10.1073/pnas.1231335100|pmid=12792023 |pmc=166184|bibcode=2003PNAS..100.8074T |doi-access=free }}</ref> Ford and Smith (2004),<ref name="Ford and Smith">{{cite journal|last=Ford|first=James D.|author2=Barry Smit |title=A Framework for Assessing the Vulnerability of Communities in the Canadian Arctic to Risks Associated with Climate Change|journal=Arctic|date=Dec 2004|volume=57|issue=4|pages=389–400|jstor=40512642|doi=10.14430/arctic516|hdl=10535/3095|hdl-access=free}}</ref> Adger (2006),<ref name=Adger>{{cite journal|last=Adger|first=W. Neil|author-link=Neil Adger|title=Vulnerability|journal=Global Environmental Change|date=August 2006|volume=16|issue=3|pages=268–281|doi=10.1016/j.gloenvcha.2006.02.006}}</ref> Fraser (2007)<ref name=Fraser>{{cite journal|last=Fraser|first=Evan D. G.|title=Travelling in antique lands: using past famines to develop an adaptability/resilience framework to identify food systems vulnerable to climate change|journal=Climatic Change|date=August 2008|volume=83|issue=4|pages=495–514|doi=10.1007/s10584-007-9240-9|s2cid=154404797|doi-access=free}}</ref>  and Patt et al. (2010)<ref name="Patt et al 2010">{{cite book|last=Patt|first=Anthony|title=Assessing vulnerability to global environmental change : making research useful for adaptation decision making and policy|year=2010|publisher=Earthscan|location=London|isbn=9781849711548|edition=1st paperback |author2=Dagmar Schröter |author3=Richard Klein |author4=Anne Cristina de la Vega-Leinert}}</ref>  amongst others, have provided a detail review of the diverse epistemologies and methodologies in vulnerability research. Turner et al. (2003)<ref name=Turner />  for example proposed a framework that illustrates the complexity and interactions involved in vulnerability analysis, draws attention to the array of factors and linkages that potentially affects the vulnerability of a couple of human–environment systems. The framework makes use of nested flowcharts to show how social and environmental forces interact to create situations vulnerable to sudden changes. Ford and Smith (2004), propose an analytical framework, based on research with Canadian arctic communities. They suggest that, the first stage is to assess current vulnerability by documenting exposures and current adaptive strategies. This should be followed by a second stage that estimates directional changes in those current risk factors and characterizes the community's future adaptive capacity. Ford and Smith's (2004) framework utilizes historic information including how communities have experienced and addressed climatic hazards, with information on what conditions are likely to change, and what constraints and opportunities there are for future adaptation.

== Standardized Government Vulnerability Assessment Services ==
 
The GSA (also known as the General Services Administration) has standardized the “Risk and Vulnerability Assessments (RVA)” service as a pre-vetted support service, to rapidly conduct assessments of threats and vulnerabilities, determine deviations from acceptable configurations, enterprise or local policy, assess the level of risk, and develop and/or recommends appropriate mitigation countermeasures in operational and non-operational situations. This standardized service offers the following pre-vetted support services:
* Network Mapping
* Vulnerability Scanning
* Phishing Assessment
* Wireless Assessment
* Web Application Assessment
* Operating System Security Assessment (OSSA)
* Database Assessment
* Penetration Testing

These services are commonly referred to as Highly Adaptive Cybersecurity Services (HACS) and are listed at the US GSA Advantage website.<ref>{{cite web |url= https://www.gsaelibrary.gsa.gov/ElibMain/sinDetails.do?executeQuery=YES&scheduleNumber=70&flag=&filter=&specialItemNumber=132+45D |title= 132-45D Risk and Vulnerability Assessment Companies |date=20 March 2018}}</ref>

This effort has identified key service providers which have been technically reviewed and vetted to provide these advanced services.  This GSA service is intended to improve the rapid ordering and deployment of these services, reduce US government contract duplication, and to protect and support the US infrastructure in a more timely and efficient manner.

132-45D Risk and Vulnerability Assessment <ref>{{cite web |url= https://www.gsa.gov/technology/technology-products-services/it-security/highly-adaptive-cybersecurity-services-hacs |title= 132-45D Risk and Vulnerability Assessment |date=20 March 2018 }}</ref> identifies, quantifies, and prioritizes the risks and vulnerabilities in a system. A risk assessment identifies recognized threats and threat actors and the probability that these factors will result in exposure or loss.

==Vulnerability to climate change==
{{Excerpt|Climate change vulnerability|Measurement tools|paragraphs=1}}

==See also==
*Vulnerability
*[[Social:Vulnerability index|Vulnerability index]]
*[[Vulnerability scanner]]
*[[Vulnerability assessment (computing)]]


==References==
# <small> Handbook of International Electrical Safety Practices </small>
<references/>


{{DEFAULTSORT:Vulnerability Assessment}}
[[Category:Risk management]]

{{Sourceattribution|Vulnerability assessment}}