Domain 4 of 4 · Chapter 4 of 4

Explain vulnerability risk, controls, and governance

Unlock the complete study guide.

Bundled into the existing CompTIA CySA+ premium course — no separate purchase.

14-day money-back guarantee — no questions asked.

Included in this chapter:

  • Controls, policies, and compliance practices used to manage risk
  • Control types: administrative, technical, physical
  • Control functions: four jobs around an event
  • Inherent risk, residual risk and risk appetite
  • The four risk management strategies
  • Vulnerability management policy and governance
  • Remediation service-level objectives (SLOs)
  • Vulnerability exceptions
  • SAST and DAST: testing code versus the running app
  • SAMM: measuring the software security program
  • Software components: SBOM, SCA and applicability
  • Supplier relationships: agreements and monitoring
  • Supply chain compromise
  • Control types, risks, and vulnerability management scenarios

Risk management strategies: accept vs transfer vs avoid vs mitigate

QuestionAcceptTransferAvoidMitigate
What the decision changesNothing new: the existing exposure is retainedWho bears specified consequences or performs specified workWhether the risk-creating activity exists at allThe likelihood or impact of exploitation
Does it fix the vulnerable code?NoNo: insurance or an agreement changes who pays or actsNo fix is needed: the vulnerable software is uninstalled or the asset decommissionedA patch or upgrade removes the flaw; a compensating control only limits exploitation
Example from NIST SP 800-40 Rev. 4Rely on existing controls, or judge the impact low enough that no more action is neededBuy cybersecurity insurance, or move to SaaS where the provider patchesUninstall the software or decommission the assetPatch or upgrade, or isolate the asset with firewalls and segmentation
What must still happenRecord the authorized decision and review itTrack the obligations the organization keepsVerify the asset is gone and stays goneVerify the fix or control works and evaluate the residual risk
Typical wrong labelCalling a new isolation control acceptanceCalling an insurance purchase remediationCalling continued use behind access controls avoidanceCalling a patch transfer

Decision tree

Is the risk-creating activitydiscontinued altogether?YesAvoiduninstall or decommissionNoAre consequences or dutiesshifted to another party?YesTransferinsurer, or provider patchesNoDoes the action lowerlikelihood or impact?YesMitigatepatch, reconfigure, isolateNoIs keeping it a recorded,approved decision?YesAcceptrecord, then reviewNoNot yet a decision:plan the risk response
Cheat sheet

Cheat sheet

  • Administrative controls establish rules and responsibilities for people
  • Technical controls enforce or observe security through system mechanisms
  • Physical controls protect physical access to facilities and equipment
  • Preventative controls act to stop an unwanted event
  • Detective controls identify events or conditions that require attention
  • Responsive controls act on a detected event
  • Corrective controls repair an identified problem or restore an acceptable state
  • Risk appetite expresses how much and what type of risk the organization is willing to accept
  • Inherent risk is assessed before focused risk-reducing actions
  • Residual risk remains after risk responses have been applied
  • Risk acceptance retains the exposure without adding a new treatment
  • Risk transfer allocates some consequences or responsibilities to another party
  • Risk avoidance removes the activity or exposure that creates the risk
  • Risk mitigation reduces likelihood or impact while managing continued use
  • Vulnerability policy establishes consistent responsibilities and response expectations
  • A remediation service-level objective is a measurable performance target
  • Vulnerability exceptions require accountable decisions and continued review
  • Vulnerability policies must be reviewed when requirements and threats change
  • SAST examines code without requiring a running application
  • DAST assesses a running application's externally observable behavior
  • A static data-flow alert requires review of the path from input to sensitive operation
  • SAMM evaluates software security practices rather than individual vulnerability severity
  • An SBOM identifies the components that make up a software product
  • SCA compares dependencies with known vulnerability information
  • Component presence does not by itself prove that a product is affected by every associated vulnerability
  • Third-party risk must be monitored throughout the relationship
  • Supplier agreements should make security responsibilities explicit
  • Supply chain compromise can deliver malicious code through trusted software

Unlock with Premium — includes all practice exams and the complete study guide.

Also tested in

References

  1. https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-40r4.pdf
  2. https://www.comptia.org/en-us/certifications/cybersecurity-analyst/v4/
  3. https://csrc.nist.gov/glossary/term/technical_controls
  4. https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r5.pdf
  5. https://csrc.nist.gov/glossary/term/management_controls
  6. https://csrc.nist.gov/glossary/term/operational_controls
  7. https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.29.pdf
  8. https://csrc.nist.gov/glossary/term/risk
  9. https://csrc.nist.gov/glossary/term/inherent_risk
  10. https://csrc.nist.gov/glossary/term/residual_risk
  11. https://csrc.nist.gov/glossary/term/risk_appetite
  12. https://csrc.nist.gov/glossary/term/risk_tolerance
  13. https://www.cisa.gov/known-exploited-vulnerabilities-catalog
  14. https://csrc.nist.gov/glossary/term/service_level_agreement
  15. https://owasp.org/www-community/Source_Code_Analysis_Tools
  16. https://owasp.org/www-project-devsecops-guideline/latest/02b-Dynamic-Application-Security-Testing
  17. https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-218.pdf
  18. https://owasp.org/www-community/controls/Static_Code_Analysis
  19. https://owasp.org/www-project-samm/
  20. https://www.cisa.gov/sbom
  21. https://owasp.org/www-community/Component_Analysis
  22. https://www.cisa.gov/sites/default/files/2023-04/minimum-requirements-for-vex-508c.pdf
  23. https://www.cisa.gov/sites/default/files/publications/defending_against_software_supply_chain_attacks_508_1.pdf
  24. https://attack.mitre.org/techniques/T1195/