Vulnerabilities, Exploits, and Threats

What is a Vulnerability?

Mistakes happen, even in the process of building and coding technology. What’s left behind from these mistakes is commonly referred to as a bug. While bugs aren’t inherently harmful (except to the potential performance of the technology), many can be taken advantage of by nefarious actors—these are known as vulnerabilities. Vulnerabilities can be leveraged to force software to act in ways it’s not intended to, such as gleaning information about the current security defenses in place.

Once a bug is determined to be a vulnerability, it is registered by MITRE as a CVE, or common vulnerability or exposure, and assigned a Common Vulnerability Scoring System (CVSS) score to reflect the potential risk it could introduce to your organization. This central listing of CVEs serves as a reference point for vulnerability management solutions.

Generally speaking, a vulnerability scanner will scan and compare your environment against a vulnerability database, or a list of known vulnerabilities; the more information the scanner has, the more accurate its performance. Once a team has a report of the vulnerabilities, developers can use penetration testing as a means to see where the weaknesses are, so the problem can be fixed and future mistakes can be avoided. When employing frequent and consistent scanning, you'll start to see common threads between the vulnerabilities for a better understanding of the full system. Learn more about vulnerability management and scanning.

Security Vulnerability Examples

A Security Vulnerability is a weakness, flaw, or error found within a security system that has the potential to be leveraged by a threat agent in order to compromise a secure network.

There are a number of Security Vulnerabilities, but some common examples are: 

• Broken Authentication: When authentication credentials are compromised, user sessions and identities can be hijacked by malicious actors to pose as the original user. 
• SQL Injection: As one of the most prevalent security vulnerabilities, SQL injections attempt to gain access to database content via malicious code injection. A successful SQL injection can allow attackers to steal sensitive data, spoof identities, and participate in a collection of other harmful activities.
• Cross-Site Scripting: Much like an SQL Injection, a Cross-site scripting (XSS) attack also injects malicious code into a website. However, a Cross-site scripting attack targets website users, rather than the actual website itself, which puts sensitive user information at risk of theft.
• Cross-Site Request Forgery: A Cross-Site Request Forgery (CSRF) attack aims to trick an authenticated user into performing an action that they do not intend to do. This, paired with social engineering, can deceive users into accidentally providing a malicious actor with personal data. 
• Security Misconfiguration: Any component of a security system that can be leveraged by attackers due to a configuration error can be considered a “Security Misconfiguration.” 

Vulnerabilities of all sizes can result in data leaks, and eventually, data breaches. What is a data leak? A data leak occurs when data is accidentally leaked from within an organization, as opposed to a data breach, which is the result of data being stolen. Data leakage is usually the result of a mistake. For example: sending a document with sensitive or confidential information to the wrong email recipient, saving the data to a public cloud file share, or having data on an unlocked device in a public place for others to see.

What is a Cybersecurity Exploit?

Exploitation is the next step in an attacker's playbook after finding a vulnerability. Exploits are the means through which a vulnerability can be leveraged for malicious activity by hackers; these include pieces of software, sequences of commands, or even open-source exploit kits. 

What is a Cyber Threat?

A threat refers to the hypothetical event wherein an attacker uses the vulnerability. The threat itself will normally have an exploit involved, as it's a common way hackers will make their move. A hacker may use multiple exploits at the same time after assessing what will bring the most reward. While nothing disastrous may have happened yet at this stage, it can give a security team or individual insight into whether or not an action plan needs to be made regarding specific security measures.

While it may seem like you’re constantly hearing about a new attack or cyber threat in the world, these terms can help give further context to the stages and dangers that security professionals deal with on a daily basis. So, what can you do to lower your overall risk? For a  proactive approach, scan your environment for vulnerabilities with a vulnerability management tool. To stay responsive to unwanted activity, Security Information and Event Management (SIEM) is a systematic process that can make it easier to control what's happening on your network. SIEM tools can help companies set up strong, proactive defenses that work to fend off or patch threats, exploits, and vulnerabilities to keep their environment safe.

Latest Patch Updates, Vulnerabilities, and Exploits

• See the most recent patches reported by the Rapid7 experts on the Patch Tuesday blog
• Search the Vulnerability & Exploit Database for updated risks
• Vulnerability Management Latest Blog Posts