Understanding Security Vulnerabilities: Vulnerabilities, Threats and Exploits
Australian companies face an average loss of $30,000 per cyber attack.
In cybersecurity, a vulnerability refers to a weakness that exposes a computer system to potential exploitation by cybercriminals, granting them unauthorised access. Once a vulnerability is exploited, cyberattacks can implant malware, execute malicious code, and pilfer sensitive data.
Vulnerabilities can be exploited through various means, such as SQL injection, buffer overflows, cross-site scripting (XSS), and open-source exploit kits, which search for known vulnerabilities and security flaws in web applications.
Numerous vulnerabilities affect widely used software, significantly increasing the risk of data breaches and supply chain attacks for many customers relying on such software. These zero-day exploits are registered by MITRE as a Common Vulnerability Exposure (CVE).
BE PREPARED: Understanding the Potential Threat to Your Business
With an ever-growing number of devices connected to the internet, hackers find ample opportunities to exploit hardware like printers, cameras, and televisions that were never designed to withstand sophisticated invasions. Consequently, both companies and individuals must reassess the security of their networks.
As cyber incidents rise, it becomes crucial to accurately assess the dangers posed to businesses and consumers alike. Two common terms often discussed in the context of cyber risks are vulnerabilities and exploits.
Distinguishing Between Vulnerabilities and Risks
It is essential to recognise that vulnerabilities and risks are not interchangeable, even though cyber security risks are sometimes referred to as vulnerabilities.
Risk can be understood as the likelihood and impact of a vulnerability being exploited.
When the probability and impact of a vulnerability being exploited are low, the risk is also low. Conversely, when the probability and impact of a vulnerability being exploited are high, the risk is likewise high.
Identifying an Exploitable Vulnerability
A vulnerability that has at least one known, functioning attack vector is classified as an exploitable vulnerability. The window of vulnerability is the period between when the vulnerability is introduced and when it is patched.
Implementing robust security practices can make many vulnerabilities non-exploitable for an organisation.
For instance, appropriately configuring S3 security can significantly reduce the probability of data leakage. Regularly checking S3 permissions is crucial to avoid potential data breaches.
Similarly, employing third-party risk management and vendor risk management strategies can help mitigate third-party and fourth-party risks.
Vulnerability, threat and risk are not interchangeable
The three words are used loosely in most security conversations, and the looseness causes real problems when it comes time to decide what to fix. The distinction is worth holding onto.
A vulnerability is a weakness: an unpatched service, a misconfigured storage bucket, a password policy that allows reuse. It exists whether or not anyone is interested in you.
A threat is someone or something with the capability and intent to exploit that weakness: a ransomware operator, an opportunistic scanner, a departing employee with access nobody revoked.
Risk is what you get when the two meet something worth protecting. A critical vulnerability on an internal test system with no real data is a low risk. A moderate vulnerability on the internet-facing system holding your customer database is a high one.
This is why a raw vulnerability scan is a poor prioritisation tool on its own. It reports vulnerabilities, not risk. Two hundred criticals sorted by CVSS score tell you nothing about which one an attacker would actually use to reach something that matters.
Prioritising when the list is longer than the budget
Every organisation has more findings than capacity. Four questions usually sort a list faster than any scoring system.
- Is it reachable from the internet? Internet-facing exposures get fixed first, almost regardless of severity. Everything else requires an attacker to already be inside.
- Is it being exploited in the wild? A known-exploited vulnerability with working public exploit code is a different proposition from a theoretical one with the same CVSS score.
- What does it reach? A weakness on a system holding personal information or credentials matters more than the same weakness on a system holding nothing.
- Does it chain? Individually unremarkable findings often combine into a full compromise. This is the one scanners miss entirely, and the main reason a penetration test finds things a scan does not.
Scanning and testing do different jobs
A vulnerability scan is automated, broad and cheap enough to run continuously. It is very good at finding known issues at scale, and it should be running between your tests rather than once a year.
A penetration test is manual, narrow and expensive. It is good at business logic flaws, chained weaknesses, access control failures and anything requiring judgement, which is most of what actually leads to a breach.
Neither replaces the other. The useful combination for most Australian organisations is continuous scanning to keep the known issues down, and periodic testing to find the things a scanner cannot see.
Siege Cyber offers continuous vulnerability scanning so new exposures surface between your annual tests. Get a Fixed-Price Quote.