Threats are more important.

5 years ago, I and most others would have said vulnerabilities. But in recent years, it has become clear that vulnerabilities are only a single part of the “cyber kill chain”, and often not the most important part. Although the kill chain model has been criticized for oversimplification, it provides valuable insights in this case.

Specifically, the kill chain lays out a number of steps an attacker must take to achieve their objective, and vulnerabilities are only relevant to a single one of these steps (exploitation). Furthermore, when most people say “vulnerabilities”, they mean 0-days, but the majority of attacks do not use 0-days. Instead they use phishing (first choice) or exploits against patched vulnerabilities (second best). Furthermore, detecting 0-days is very hard, because by their nature they are unknown, and attackers generally test them against the victim’s known software configuration to ensure success without detection. Detecting attacks against patched vulnerabilities is also somewhat difficult since by definition an unpatched machine is not being properly maintained. Furthermore, even an attacker who is detected can come back later with a different attack, trying again and again until they succeed without detection. We tried for something like 15 years to defeat exploits by fixing vulnerabilities and developing mitigation technologies such as stack cookies and ASLR, and while these technologies have unquestionable raised the bar for and cost of exploitation, they have fundamentally failed to stop attackers from finding and exploiting vulnerabilities. The same is true of the broader spectrum of non-technical vulnerabilities such as social engineering and password reuse - we have known these things are problems for 20+ years, and yet we have been unable to close the vulnerability completely.

On the other hand, once an attacker has established a foothold in the defender’s network, the balance of power shifts in the defender’s favor. Now the attacker must remain hidden while the defender can catch them at any moment. Any action the attacker takes may tip off the victim, and even if the attacker is silent, new information provided by third parties or new detection techniques implemented by the victim organization may identify the attacker. Once the victim identifies the attacker, they can use logs to trace the threads of the attacker’s activity, identify the extent of their penetration, and remove them from the network. For this reason, modern cybersecurity organizations place a large emphasis on threat intelligence about the adversaries who are likely to attack their organizations, and use that intelligence to prevent and detect the attacks they are likely to face at all stages of the kill chain. Smart organizations now “assume breach” and spread their focus beyond vulnerabilities to other aspects of the attacker’s operation, such as lateral movement, persistence, data access, and exfiltration. John Lambert’s article on “list thinking vs. graph thinking” is very insightful on this topic.

This represents a change from 5 years ago where preventing the attacker from accessing the corporate network was the primary emphasis. This is now sometimes referred to as “M&M security” - hard on the outside but with a soft gooey inside. This shift is exemplified by Google’s Beyond Corp model, in which connecting via the corporate network confers no special privileges.

To summarize: in modern cybersecurity, threats are more important than vulnerabilities because they are easier to identify and do something about.

Data are critical to businesses in today's world and the security of that data. Customers expect your data to be safe and you will lose your business if you can't keep it secure. Many clients with confidential information practically require that before doing business with you you be provided with a strict data protection framework.

To fix data protection issues that could potentially affect your company, the relationship of three core components: danger, vulnerability and risk is crucial to understand. While these technical words are used interchangeably, they have distinct meanings and consequences.

1- Vulnerability vs. Threat

A. Threat

A danger is a new or newly discovered event that may damage a device or the business as a whole. Three major threats are identified:

- Natural disasters: including inundations, hurricanes or tornadoes.

- Unintended Risks: like the incorrect exposure by an employee to false knowledge.

- Intended Threats: like spyware , ransomware, adware, or an unwelcome employee's behaviour.

Worms and viruses are classified as threats because, unlike human-caused, they can cause damage to your organisation by exposing you to an automated attack. On May 12, 2017, the most recent WannaCry Ransomware Attack targeting computers and networks around the world became the largest such attack. The 2017 Internet Security Threat Report shows that cyber criminals are constantly seeking innovative new ways to compromise their data.

These threats can be uncontrollable and often difficult or unidentifiable beforehand. Furthermore, these interventions allow you to constantly assess risks so that when a crisis arises, you can become more prepared. Many ways to do this are here :

• The Team Members are Aware of Emerging Technology Developments: such that potential threats are easily detected. They should subscribe to blogs (like Wired) and podcasts that cover these matters like Techgenix Extreme IT and join professional organisations to take advantage of news feeds, conferences and webinars.
• Conduct Periodic Threat Assessments: along with evaluation of different types of threats, to evaluate the best ways to defend a network against a particular threat
• Perform Insight Experiments: to identify vulnerabilities by modelling real-world risks.

B. Vulnerability

A vulnerability is the known weakness of an asset (resource) which one or more attackers can exploit. In other words, it is a well-known problem that can succeed in an attack. It leaves the business vulnerable to both deliberate and accidental menaces, for example when you give up and forget disabling their access to external accounts, modifying logins or withdrawing their names from client credit cards. However, automated attackers use most vulnerabilities and not the typing of humans on the other side of the network.

To ensure the continued protection of your systems, vulnerability testing is important. You may develop a plan for rapid response by finding weak points. Here are a number of questions for identifying your vulnerabilities in security:

• Is your data securely saved and stored off-site ?
• Is the cloud data saved? If so, how exactly is cloud vulnerabilities protected ?
• Which sort of network protection have you to find out who can access, alter, or remove data from your company ?
• Which form of protection is being used for antivirus? Do the licenses have been updated? Does it work as much as necessary ?
• Have you a data recovery strategy for leveraging a vulnerability ?

The first step in controlling the risk is knowing the vulnerabilities.

2- Conclusion

Let's use the real-world example of a hurricane to illustrate the concepts of danger, vulnerability and risk. A hurricane's threat is not in one 's hand. So realising that a hurricane might strike business owners will assess vulnerabilities and create an action plan to mitigate the effects. Under such a case, if the hurricane caused damage to your physical properties, a weakness will not be identified with a data recovery plan. The danger for your company is knowledge loss or business interruption because the vulnerabilities are not addressed.

Understanding such safety components correctly will allow you to develop a system to detect possible threats, recognise and fix your weaknesses to mitigate risks.

Heh! No. One does not exist without the other. Nothing is a threat unless you have a vulnerability. Conversely, you have no vulnerabilities unless you have an actual threat.

For example, are we threatened by earthworm? Perhaps in some worms’ minds we are, but we have no vulnerabilities that an earthworm can touch, so to us they are not a threat. Some spiders, however, are a threat because we have soft penetrable skin and nerves that can be destroyed by microscopic quantities of arachnid neurotoxins.

On the other hand, we are totally vulnerable to flying saucer weapons, but because we do not consider we are threatened by flying saucers, we do not consider we have a vulnerability.

Hi

The most important thing about being a cyber security professional is that we focus on the possible ways in which the security of the system can be compromised. The security of the system can be seen as a possible threat to the system or at times the vulnerabilities in the services that are running on the system

What I mean to say here is that as an experts we must be conscious of the possible ways in which the security may be compromised and not the how the attacker manages to do it..

If you have a secure system then the methods are not for you to be bothered about for .

I hope you have got the point, if there is anything more that you would like me to explain to you than please let me know.

Good Luck!

I like this question, but I think perhaps the answer is “Neither. Focus on risk.”

If we're to really think about what the job of information security is, it is to protect information assets. Another way of saying that is “to mitigate risks of loss, corruption or undesirable disclosure of information.”

One commonly used formula for describing risk is “impact x likelihood.” Impact and likelihood of what, you ask? One answer might be “the impact and likelihood of a threat exploiting a vulnerability.”

If that makes sense to you, then you can see why a focus on either threats or vulnerabilities to the exclusion of the other is unlikely to help you mitigate your risk.

For cybersecurity professionals, both threats and vulnerabilities are important to focus on.

Threats refer to the potential harm or damage that could be inflicted on an organization or individual through a cyber attack. This can include unauthorized access to sensitive information, data breaches, theft of intellectual property, and disruption of critical systems. Understanding the nature and characteristics of different threats is crucial for identifying and preventing attacks.

Vulnerabilities, on the other hand, refer to weaknesses in a system or network that can be exploited by attackers to carry out a threat. Vulnerabilities can exist in software, hardware, or processes and can range from outdated software to misconfigured systems. Identifying and fixing vulnerabilities is crucial for preventing successful attacks.

Thus, cybersecurity professionals need to be aware of both threats and vulnerabilities in order to effectively protect their organizations against cyber attacks. This requires a proactive approach that involves continuous monitoring, risk assessments, and implementing security measures to detect and respond to cyber threats.

Great News… we can have both, it’s not an inverse relationship. Increasing security does not mandate decreasing privacy.

There’s a profound difference between the targeted penetration of a given individual’s privacy based on probable cause, and the large-scale penetration of everyone’s privacy simply because a strong internet and weak legislation now make it possible.

Not so long ago your privacy was protected by potent laws that prohibited anyone from intercepting your communications, no matter if the attacker was a government, a corporation or an individual. It was and remains highly illegal to open a sealed letter sent by first-class mail, or to place a wiretap on a telephone line, without a court order based on strong probable cause.

Absolutely no such laws protect the digital versions of those things. Consider this…

• It’s illegal to wiretap people’s phones, so why don’t we have the same laws to protect their VoIP calls? (things such as Skype, for example).
• It’s illegal to intercept and open people’s physical first-class mail, so why don’t we have the same laws to protect their email?
• It’s illegal to place bugs in people’s homes, so why don’t we have laws that tightly regulate what systems such as Alexa, Siri or Cortana can transmit back to their respective companies for permanent archiving?
• Although it’s legal to watch people or photograph/film them in public, it’s illegal to stalk them from place to place. So why don’t we have laws to prevent facial recognition technology from being used across networked video surveillance systems from doing exactly that: stalking everyone they see, identifying them and prompting action.
• It’s also illegal to stalk people physically, so why don’t we have laws to tightly restrict digital stalking by the collection of GPS data from people’s phones? This is being done on a massive scale, and used to analyze not only where you go, but also who you are with (by matching up GPS tracks).

Think about it folks… We have strong laws to protect the physical implementation of these things, but virtually no protection now that it can all be done digitally.

The digital world is a vital representation of the physical one; it deserves exactly the same legal protections. Probably more.

I had an odd realisation this afternoon walking past an iPhone ad on a massive billboard like this one. I found it ironic.

Because nothing says ‘privacy’ like a giant sign of someone you don’t know pointing their camera at you.

Anyway, it made me realise that I’m really not that uncomfortable with the idea of being monitored all the time - and the reason for that is somewhat interesting in a psychological sense.

I say this prayer occasionally. The fact is that I actually assume that nothing about me is ever hidden from the one authority that actually matters. If I think about it, I kind of assume I’m ‘under surveillance’ all the time. I’m ok with that.

Of course, that’s because I trust the authority in question. Profoundly, I realised that I don’t actually necessarily believe God would be ‘on my side’ - more that I trust His judgement is good.

Thus, to me, security in the form of isolation (which is what privacy is) only makes sense when we are good and the people and things around us are bad. In a way, I’m more uncomfortable with that perpetual fear than I am with people seeing who I am and what I do. That’s just reality. I can’t deny it.

Don’t worry, I’m not so naive as to believe that posting my credit card here is a good idea, but as I think about these things, the following verses ring in my ears.

“And they heard the sound of the Lord God walking in the garden in the cool of the day, and the man and his wife hid themselves from the presence of the Lord God among the trees of the garden.”

Genesis‬ 3:8‬ ESV‬‬

What do we assume as security?.

Money, house, relations, wife, kids, power, guards, etc. These are all assumed as security to us. They are only giving comforts you need at times, not securities. You get anything with money, get things done with power and persons, seems to get pleasure and happiness from wife and kids.

Once your power is gone, you wife dead, kids away from you in foreign lands, you are afraid lif life. You feel you have lost your security.

When you are insecure without money, power, etc, you have nothing more to lose. Only you have to gain so.ething at all times. Poor people are always look happy, because they have nothing to lose. All circumstances are favourable to them, because they are always insecure in life.

That is the biggest security for them. An insecure man has nothing to fear, possess, lose. That is the biggest security.

Till you live, you are insecure , because anytime death will come and catch you. But a dying man is more secure. Because he need not worry about death anymore. Fear is away.

Well, firstly it depends on what kind of security threats your talking about. If your talking about break ins or home invasions Id have to guess there is little to no evidence that a smart house would be any more at risk of an incident then a regular house. If your talking about cyber security threats then the answer is an obvious yes. The more you expose yourself to the internet your possibility of being attacked goes up. Just like if your driving a car your possibility of dyeing in a car wreck goes up exponentially compared to when you are in the bathtub.

Now, that being said there are two little things to take into account that might nullify my entire argument. Having more smart devices might put you at a higher risk of a targeted attack. Electronics are a big target for thieves. Electronics are usually very small (comparatively speaking), easy to take, and there's a strong market for them. Secondly, it depends on the smart devices the person has in the home. If the home has smart locks on every outside door this could lead to a more sophisticated thief choosing your house because electronic locks are subject to certain attacks that regular locks are not, some of which are ALOT easier then picking. Don't believe me? YouTube someone called the lock picking lawyer and you'll see that a lot of what you think about locks is wrong.

Cell phones.

For the record, I have no plans or want to do anything like this, but I have a particular set of skills…

You have fucking clue how often I see cops who are meant to be protecting things, at the very least, themselves, just sitting around playing with cellphones. A security guard, up to and including real cops mean nothing. You can shoot them down in their cars with the doors open as if it were a park bench, playing CandyCrush. It would be like shooting babies in a barrel. Ya’ heard me.

Everyone would have to close out of the Grinder tab before they can look up and get a good description.

I have worked for and consulted for Universities in the past, always facing the same quandary. How to allow open access but maximum security at the same time. Answer is you cannot without making students feel as though they are being cheated. Either way students themselves become their own worst enemy high rates of security while being granted the greatest amount of access possible.

In the end its like having to enforce the honor system where everyone abides by the rules out of free will alone. Since this works so well with college age students you can imagine the outcomes on campus.

Oh and I might add that professors are often an even worse enemy, blatantly breaking obvious security rules because it pleases them to play the rebel but complain viciously to administration that the administrators aren’t doing enough to “protect” them.

Colleges and Universities cannot be considered “safe” security wise until the security and safety culture puts real value into it. Until then your tax dollars will be funding more espionage attacks against them and your Intellectual Property will be sold to the highest bidder.

Won’t bother with credentials as their are people who complain about them with such immediate enthusiasm that they are immediately down voted. Security people are like that in real life more so than other fields I interact.

Most have pretty good security. But a surprisingly larger number of them don’t sanize their error paths, at which point it’s vulnerable.

The ironic thing is you can do this at the login validation on a web form, even if it’s just to view the account contents, which — in theory — requires less security.

So you enter an email address that the “is this a valid email address?” checker will thow out, and on the end of the string you do a “Little Bobby Tables” attack, and it’s successful, because you are doing itin a failure occuring on the input sanitization path, so everything is already open for the checking, and in theory the sanitizer doesn’t have bugs itself.

I chortled when I found the same problem on several government web sites in California, and several major food delivery services.

Nobody is perfect, but a lot of the people doing the security for these sites are ordinary engineers, with no experience actually hacking anything.

I call this “hack blindness”. Most people, even those who think they are “trained in cybersecurity” have it, which I suppose they could also print out on a piece of paper, to hang next to their security certificates.

A

Vulnerability is weakness in the system that can be exploited. Vulnerability could be,

Technical vulnerability : Weakness in the infrastructure, Application vulnerability (XSS, SQL injection, Weak encryption, File injection, … )

Process vulnerability : Loopholes in the process (Code verification issues, Configuration management issues, Version control issues, Avoiding hierarchy……)

Physical vulnerability : Unauthorised access to physical devices ,medium, computers (changing the password , Accessing files by inserting boot CD, Copying/Downloading files by inserting USB drive into computers, Switching Off the computer/Server leading to DoS attack/ non-availability of resources/services)

Human vulnerability : Ignorance, Accidental deletion, Lost/Stolen data devices are few such examples.

Where do I start…?

For a start, there are literally millions in the world today - but for hackers to find them, they need to do as much reconnaissance as possible. The example vulnerabilities in this article are real and to the best of my knowledge accurate.

Sometimes, by accident, it is possible to find an exploit where you could try numerous vulnerabilities at the server.

However, things are not that simple - you also need to know how to cover your “digital footprint”, leaving no traces whatsoever behind you. In order to do this, any logs on a web server must be wiped, so no IP addresses are available.

This can be done using bash or directly in Linux, however, this only works if the server has the logs set up in the default locations. It is quite easy to code a script to find them and erase all data.

Let’s say for an example I wanted to find all web servers globally that have not been patched since 2014.

So, say I need to look for servers not patched since 2014 and still have the “Heartbleed” bug - CVE-2014-0160 - (Common Vulnerabilities and Exposures) is the Standard for Information Security Vulnerability Names.

The number is the year release of the patch, this does not mean all web servers were patched. We can build a report by using the Shodan search engine and entering the CVE number, a few hours would be enough for us to see the actual number of unpatched servers.

At the moment I would estimate that it would be around 90k-100k of vulnerable web servers that have still yet to be patched.

Now, this is just one CVE, there are many more, so you can now understand how and why so many companies are hacked, many have poor security.

I did contact one company about this bug on their website, the reply I got back was what I expected. It was along the lines of:

“We know about the “Heartbleed bug”, however, we use it and the port it runs on.”

This was obviously someone that knew nothing of the consequences of the bug not being patched. I could have easily used just one line of code in any browser and “pharmed” their database for usernames, passwords, and email addresses.

There are so many companies with the same attitude, and it is pointless trying to get through to them, I have even contacted web hosting companies.

Cybersecurity vulnerabilities come in many forms and there are literally millions of insecure web-servers, carrying them. If it was a website I owned, I would have fixed it back in 2014, when the patch was released. Some, go back even further, I think the longest running vulnerability is nearly 15yrs old now - and yet some servers have still not fixed the issues.

Staying up to date with new threats and vulnerabilities is crucial for maintaining cybersecurity. Here are several effective strategies to achieve this:

1. **Subscribe to Security News Outlets**: Follow reputable cybersecurity news websites and blogs such as Krebs on Security, Threatpost, and SecurityWeek. These platforms provide timely updates on emerging threats.

2. **Follow Vendor Alerts**: Keep an eye on announcements and security advisories from major software and hardware vendors (e.g., Microsoft, Adobe, Cisco). They often publish vulnerability notices and patches.

3. **Join Security Mailing Lists**: Subscribe to mailing lists like those managed by CVE (Common Vulnerabilities and Exposures), US-CERT, or SANS Internet Storm Center for alerts on new vulnerabilities.

4. **Utilize Threat Intelligence Platforms**: Implement threat intelligence services that aggregate data about vulnerabilities and emerging threats. Tools like Recorded Future, FireEye, or Anomali can provide valuable insights.

5. **Attend Conferences and Webinars**: Participate in cybersecurity conferences, webinars, and workshops (like RSA, Black Hat, or DEF CON) to learn from experts and stay informed about the latest research and trends.

6. **Engage in Online Forums and Communities**: Join forums on platforms like Reddit, Stack Overflow, and specialized cybersecurity communities to discuss vulnerabilities and share knowledge with peers.

7. **Read Security Research Papers**: Keep up with the latest research by reading academic papers and industry whitepapers that address new threats and vulnerabilities.

8. **Follow Influential Researchers and Experts**: On social media platforms like Twitter, follow cybersecurity experts, researchers, and organizations who regularly share insights about vulnerabilities and attacks.

9. **Stay Informed via Podcasts and YouTube Channels**: There are numerous podcasts and YouTube channels dedicated to cybersecurity that cover current events, threats, and best practices.

10. **Engage with Government and Regulatory Agencies**: Regularly check updates from governmental institutions like the NIST, FBI, and EU Agency for Cybersecurity (ENISA) for guidelines and alerts regarding cybersecurity threats.

By utilizing a combination of these strategies, individuals and organizations can maintain an informed stance on the evolving landscape of cybersecurity threats and vulnerabilities.

In the context of cyber security in general, and computer security in particular, vulnerabilities, threats and attacks represent an “incremental relationship”. To start off, each one of the three represents some sort of attack vector, which can potentially harm an organization in one way or the other.

Now that we have established an incremental relationship among Vulnerabilities, Threats and Attacks, let us discuss each one of these to elaborate further. A vulnerability could represent any weakness, flaw or lapse within the cyber security posture of an enterprise that could potentially be exploited by some rogue cyber element.

Another way of defining a vulnerability is that it could be something relatively insignificant initially, but has the potential to become extremely damaging for an affected enterprise. An objective analysis of every vulnerability needs to be carried out as early as possible, to avert bigger losses and devastating cyber security incidents.

The next stage that any cyber security challenge can achieve is in the form of a real-time threat. Enterprises face a wide range of threat vectors, each having a certain degree of importance, and potential for inflicting serious damages.

Here, we will also have to concur with the opinion of some cyber security experts that vulnerabilities signify the challenges to security generally posed by internal stakeholders, such as employees. Threats, on the other hand, mostly originate from outside the organization.

A cyber attack is the ultimate manifestation of a cyber security vulnerability or threat. In other words, this is the “real deal”, and enterprises need to be well prepared for cyber attacks in advance.

Cyber attacks could happen as a result of any vulnerability or threat, which existed within the IT infrastructure of the targeted enterprise. It is quite possible that a cyber attack has exploited some already known vulnerability, or exposed an entirely new threat or vulnerability within the IT infrastructure.

In view of the above, perhaps the best course of action for enterprises is to invest in the right technologies and tools that can help them identify potential vulnerabilities and threats, well before some cyber security incident actually happens.

It is pertinent to mention here that organizations need to adopt a two-pronged approach to dealing with present day cyber threats. First and foremost is the development and / or deployment of preventive cyber security tools.

The other aspect, which is equally important, is developing a robust Business Continuity (BC) plan, in case a cyber attack is actually able to circumvent the cyber security protocols that are already in place.

Lastly, cyber security vulnerabilities, threats and attacks are constantly evolving. It is critical for enterprises to invest in the right technologies, tools and human resources that can always keep them one step ahead of cyber security threats.

Security threats and vulnerabilities are sometimes used interchangeably, however, they are not the same. A threat could be some event or a person having the potential of impacting some valuable resources negatively. On the other hand, vulnerabilities correspond to the quality of resource or environment that helps allow threats identification.

In the field of network security, threats, and vulnerability detection are important to mitigate the high risks associated with the network system of a software application. To combat a variety of cyberattacks, vulnerability detection is crucially important. It helps fill up the loopholes that can easily be exploited by the fraudulent entities.

I hope this helps!