Vulnerability

From CIPedia
Revision as of 02:17, 24 May 2015 by Eluiijf (talk | contribs) (→‎Standard Definition)
Jump to navigation Jump to search

Definitions

European Definitions

A characteristic of an element of the CI’s design, implementation, or operation that renders it susceptible to disruption or destruction by a threat and includes dependencies on other types of infrastructure. [1]


Other International Definitions

NATO CEP / EAPC

A characteristic of an element of the critical infrastructure’s design, implementation, or operation that renders it susceptible to destruction or incapacitation by a threat. [2]


UNISDR

The characteristics and circumstances of a community, system or asset that make it susceptible to the damaging effects of a hazard [3].

There are many aspects of vulnerability, arising from various physical, social, economic, and environmental factors. Examples may include poor design and construction of buildings, inadequate protection of assets, lack of public information and awareness, limited official recognition of risks and preparedness measures, and disregard for wise environmental management.

Vulnerability varies significantly within a community and over time. This definition identifies vulnerability as a characteristic of the element of interest (community, system or asset) which is independent of its exposure. However, in common use the word is often used more broadly to include the element’s exposure.

National Definitions

Australia

Vulnerability is the degree of susceptibility and resilience of the community and environment to hazards. [4]


Vulnerability is the degree of loss to a given element at risk or set of such elements resulting from the occurrence of a phenomenon of a given magnitude and expressed on a scale of 0 (no damage) to 1 (total loss). [4]


Czech Republic

Vulnerability is a weak spot of an asset or control which can be made use of by a threat.[5]

Slabé místo aktiva nebo řízení, které může být využito hrozbou.

France

(in French) Vulnérabilité: propension d’un milieu, d’un bien ou d’une personne à subir des conséquences dommageables à la suite d’un événement. Elle ne produit pas nécessairement de dommage par elle-même [6].

Non-official translation: propensity of an environment, a good or a person to suffer from adverse consequences as a result of an event. It does not necessarily produce damage itself.

Kingdom of Saudi Arabia

A vulnerabiliuty is a defect or weakness in system security procedure, design, implementation, or internal control that an attacker can exploit.[7]


Norway

The vulnerability of a system is an expression of the weaknesses and deficiencies in the system and special circumstances increases the likelihood that threats will materialize in a security incident (Sårbarheten til et system er et uttrykk for de svakheter og mangler som finnes i systemet og spesielle omstendigheter som øker sannsynligheten for at trusler vil materialisere seg i en sikkerhetshendelse).[8]

Examples of special circumstances may be size, complexity, that many actors are involved, geographical spread, frequent changes and deferred location.

United States

DHS
A physical feature or operational attribute that renders an entity open to exploitation or susceptible to a given hazard [9].
NIST
A vulnerability is a weakness in an information system, system security procedures,internal controls, or implementation that could be exploited or triggered by a threat source.[10]

The document provides several definitions.


Other Definitions

Ontario (Canada)

Vulnerability is the susceptibility of a community, system or asset to the damaging effects of a hazard. [11]


Vulnérabilité: susceptibilité d’une collectivité, d’un système ou d’un bien à subir les effets dommageables d’un danger. [12]


Standard Definition

ISO 22300:2012(en)

Intrinsic properties of something resulting in susceptibility to a risk source that can lead to an event with a consequence .[13]


ISO/IEC 27000:2014

Weakness of an asset or control that can be exploited by one or more threats [14].

See also

Notes

  1. ↑ EC COM(2006) 787 final, Directive of the Council on the identification and designation of European Critical Infrastructure and the assessment of the need to improve their protection, EC, Brussels 12.12.2006.
  2. ↑ NATO EAPC(SCEPC) lexicon 2003.
  3. ↑ 2009 UNISDR Terminology on Disaster Risk Reduction
  4. ↑ 4.0 4.1 Australian Emergency Management Glossary, Emergency Management Australia (1998)
  5. ↑ Act No. 181 of 23 July 2014 On Cyber Security and Change of Related Acts (Act on Cyber Security)
  6. ↑ INSTRUCTION GENERALE INTERMINISTERIELLE RELATIVE A LA SECURITE DES ACTIVITES D’IMPORTANCE VITALE N°6600/SGDSN/PSE/PSN du 7 janvier 2014, PREMIER MINISTRE, SECRETARIAT GENERAL DE LA DEFENSE ET DE LA SECURITE NATIONALE, Direction Protection et Sécurité de l’Etat N° NOR: PRMD1400503J
  7. ↑ Developing National Information Security Strategy for the Kingdom of Saudi Arabia NISS draft 7
  8. ↑ Nasjonal strategi for informasjonssikkerhet (2012)
  9. ↑ DHS Risk Lexicon 2010 Edition, September 2010
  10. ↑ NISTIR 7298 rev 2: Glossary of Key Information Security Terms, May 2013/NIST SP 800 series
  11. ↑ Province of Ontario’s Emergency Management Glossary of Terms
  12. ↑ Province of Ontario’s Emergency Management Glossary of Terms
  13. ↑ ISO 22300:2012(en) Societal security — Terminology
  14. ↑ ISO/IEC 27000:2014, Information technology -- Security techniques -- Information security management systems -- Overview and vocabulary
Retrieved from "https://websites.fraunhofer.de/CIPedia/index.php?title=Vulnerability&oldid=2484"