Threats, Vulnerabilities, and Risk Management

This set covers key terminology for DACS 2201, including vulnerabilities, scanning types, threat definitions, and risk management strategies.

Vulnerability

A weakness, or a hole in the system that makes the system exposed to the possibility of being attacked or harmed.

Exploit

An action that takes advantage of a critical vulnerability to cause unintended behavior.

Patches

Software updates provided by vendors to fix bugs and close vulnerabilities throughout the planned lifecycle of their software.

Legacy Platforms

Older computer systems with old operating systems that cannot be updated anymore and do not receive security updates.

On-Premises Platforms

A computing model where all hardware and software are maintained at the company's physical location.

Cloud Platforms

Complex computing resources accessible from virtually anywhere that often introduce vulnerabilities as a result of misconfiguration.

Zero Day

Vulnerabilities that have not been patched yet, where the patch is either incomplete or the vulnerability is unknown to the vendor.

Vulnerability scan

A frequent and ongoing process that continuously identifies vulnerabilities and monitors cybersecurity progress to create a mitigation strategy.

Mitre Common Vulnerabilities and Exposures (CVE)

A list that identifies vulnerabilities in operating systems and application software, used to feed vulnerability scanning software.

Credentialed Scan

A scan where valid authentication credentials, such as usernames and passwords, are supplied to the scanner to mimic a threat actor who possesses them.

Non-credentialed Scan

A vulnerability scan conducted without providing any authentication information.

Intrusive Scan

A scan that attempts to employ any vulnerabilities it finds; while more accurate, it can impair the target system.

Nonintrusive Scan

A scan that does not attempt to exploit the discovered vulnerability but only records it.

Threat

Something that has the potential to cause harm and compromise the Confidentiality, Integrity, and Availability (CIA) of a system.

Risk

The likelihood that something bad will happen, requiring both a vulnerability and a threat that could exploit it.

Impact

A factor used (by organizations like the NSA) to calculate risk by taking into account the value of the asset being threatened.

Risk Management

The steps taken to prevent or mitigate risks in an environment, including identifying assets, threats, and assessing vulnerabilities.

Physical controls

Risk mitigation measures such as fences, gates, cameras, and fire suppression systems.

Logical controls

Security measures such as access control (privileges), data encryption, and intrusion detection systems (IDS).

Administrative controls

Controls based on rules, laws, policies, procedures, and guidelines.

Defense in depth

A strategy based on using multiple overlapping security mechanisms to maintain resistance should one or more defensive measures fail.