Evaluate Security Threats and Vulnerabilities

More devices are online than ever before, and many of them, from printers to cameras, were never designed to withstand sophisticated attacks. That reality is forcing businesses and individuals to reexamine how secure their networks really are. To do that, you first need to understand the difference between a vulnerability and a threat.

What Is a Vulnerability?

A vulnerability is a weak spot, flaw, or other issue in a system, whether infrastructure, a database, or software. It can also exist in a process, a set of controls, or the way something is implemented or delivered. Vulnerabilities can be used to make software behave in unintended ways, such as revealing details about the security mechanisms in place.

Once a problem is determined to be a vulnerability, MITRE records it as a CVE (Common Vulnerabilities and Exposures) and assigns it a score under the Common Vulnerability Scoring System (CVSS) to represent the potential risk it may pose. This central collection of CVEs is used as a resource by vulnerability scanners.

A vulnerability on its own is not necessarily a problem. Leaving your door unlocked while you sleep is a potential vulnerability. It is not a problem by itself, but if the wrong person walks through that door, bad things can happen.

Examples of Vulnerabilities

• Broken authentication: When a user's credentials are stolen, malicious actors can use that identity and session to impersonate the user.
• SQL injection: Injecting malicious code to access database content. A successful SQL injection can let attackers steal sensitive data, assume identities, and carry out other destructive actions.
• Cross-Site Scripting (XSS): Adds malicious code to a website. Because XSS targets website visitors rather than the site itself, it puts user data at risk.
• Cross-Site Request Forgery (CSRF): Coerces an authenticated user into performing an action they did not intend, often combined with social engineering.
• Security misconfiguration: Any configuration error that attackers can exploit.

What Is a Threat?

A threat is the potential event in which an attacker exploits a vulnerability. An exploit is typically part of the threat, because that is how attackers move. After determining which exploits will yield the greatest gain, an attacker may use several at once. Understanding these terms helps security professionals comprehend the stages and risks they face every day.

Examples of Security Threats

• A malicious user examines other users' files.
• A web server's requests are redirected to the attacker's own server.
• The database is altered by an attacker.
• A remote attacker issues commands on the server.

These examples map cleanly to STRIDE categories. Malware, trojans, and worms are further examples.

Reducing Your Risk

Conduct a proactive vulnerability scan of your environment using a vulnerability management tool. A rigorous process called Security Information and Event Management (SIEM) can help you keep tabs on network activity while staying alert to unauthorized behavior. Businesses can use SIEM technology to build strong, proactive defenses that stop attacks, exploits, and vulnerabilities before they impact IT environments.

Conclusion

No matter how sophisticated your systems are, you cannot completely remove or guard against all threats. This is where risk management comes in, a regular, continuous process in which the appropriate staff periodically review risks to reduce the likelihood that certain threats will materialize.