User:Buidhe paid/Vulnerability (computing)
Part of a series on |
Computer hacking |
---|
Vulnerabilities are flaws in a computer system that weaken the overall security of the system.
Despite intentions to achieve complete correctness, virtually all hardware and software contains bugs where the system does not behave as expected. If the bug could enable an attacker to compromise the confidentiality, integrity, or availability of system resources, it is called a vulnerability. Insecure software development practices as well as design factors such as complexity can increase the burden of vulnerabilities. There are different types most common in different components such as hardware, operating systems, and applications.
Vulnerability management is a process that includes identifying systems and prioritizing which are most important, scanning for vulnerabilities, and taking action to secure the system. Vulnerability management typically is a combination of remediation (fixing the vulnerability), mitigation (increasing the difficulty or reducing the danger of exploits), and accepting risks that are not economical or practical to eliminate. Vulnerabilities can be scored for risk according to the Common Vulnerability Scoring System or other systems, and added to vulnerability databases. As of 2023[update], there are more than 20 million vulnerabilities catalogued in the Common Vulnerabilities and Exposures (CVE) database.
A vulnerability is initiated when it is introduced to into hardware or software. It becomes active and exploitable when the software or hardware containing the vulnerability is running. The vulnerability may be discovered by the vendor or a third party. Disclosing the vulnerability (as a
Causes
Despite developers' goal of delivering a product that works entirely as intended, virtually all
Design factors
Fundamental design factors that can increase the burden of vulnerabilities include:
- Complexity: Large, complex systems increase the probability of flaws and unintended access points.[10]
- Familiarity: Using common, well-known code, software, operating systems, and/or hardware increases the probability an attacker has or can find the knowledge and tools to exploit the flaw.[11]
- Connectivity: any system connected to the internet can be accessed and compromised. Disconnecting systems from the internet is one truly effective measure against attacks, but it is rarely feasible.[12]
Development factors
Some
DevOps, a development workflow that emphasizes automated testing and deployment to speed up the deployment of new features, often requires that many developers be granted access to change configurations, which can lead to deliberate or inadvertent inclusion of vulnerabilities.[16] Compartmentalizing dependencies, which is often part of DevOps workflows, can reduce the attack surface by paring down dependencies to only what is necessary.[17] If software as a service is used, rather than the organization's own hardware and software, the organization is dependent on the cloud services provider to prevent vulnerabilities.[18]
National Vulnerability Database classification
The National Vulnerability Database classifies vulnerabilities into eight root causes that may be overlapping, including:[19]
- input checking is not sufficient to prevent the attacker from injecting malicious code.[20]
- Access control vulnerabilities enable an attacker to access a system that is supposed to be restricted to them, or engage in privilege escalation.[20]
- When the system fails to handle and exceptional or unanticipated condition correctly, an attacker can exploit the situation to gain access.[21]
- A configuration vulnerability comes into existence when configuration settings cause risks to the system security, leading to such faults as unpatched software or file system permissions that do not sufficiently restrict access.[21]
- A race condition—when timing or other external factors change the outcome and lead to inconsistent or unpredictable results—can cause a vulnerability.[21]
Vulnerabilities by component
Hardware
Deliberate security bugs can be introduced during or after manufacturing and cause the integrated circuit not to behave as expected under certain specific circumstances. Testing for security bugs in hardware is quite difficult due to limited time and the complexity of twenty-first century chips,[22] while the globalization of design and manufacturing has increased the opportunity for these bugs to be introduced by malicious actors.[23]
Operating system
Although
Client–server applications
Client–server applications are downloaded onto the end user's computers and are typically updated less frequently than web applications. Unlike web applications, they interact directly with a user's operating system. Common vulnerabilities in these applications include:[26]
- Unencrypted data that is in permanent storage or sent over a network is relatively easy for attackers to steal.[26]
- computer process.[26]
Web applications
- Authentication and authorization failures enable attackers to access data that should be restricted to trusted users.[27]
- domain object model.[29]
- database queries to gain unauthorized access to data.[29]
- Cross-site request forgery (CSRF) is creating client requests that do malicious actions, such as an attacker changing a user's credentials.[29]
- Server-side request forgery is similar to CSRF, but the request is forged from the server side and often exploits the enhanced privilege of the server.[29]
- Business logic vulnerability occurs when programmers do not consider unexpected cases arising in business logic.[30]
Management
There is little evidence about the effectiveness and cost-effectiveness of different cyberattack prevention measures.[31] Although estimating the risk of an attack is not straightforward, the mean time to breach and expected cost can be considered to determine the priority for remediating or mitigating an identified vulnerability and whether it is cost effective to do so.[32] Although attention to security can reduce the risk of attack, achieving perfect security for a complex system is impossible, and many security measures have unacceptable cost or usability downsides.[33] For example, reducing the complexity and functionality of the system is effective at reducing the attack surface.[34]
Successful vulnerability management usually involves a combination of remediation (closing a vulnerability), mitigation (increasing the difficulty, and reducing the consequences, of exploits), and accepting some residual risk. Often a
Remediation
Remediation fixes vulnerabilities, for example by downloading a
Vulnerabilities can only be exploited when they are active-the software in which they are embedded is actively running on the system.[40] Before the code containing the vulnerability is configured to run on the system, it is considered a carrier.[41] Dormant vulnerabilities can run, but are not currently running. Software containing dormant and carrier vulnerabilities can sometimes be uninstalled or disabled, removing the risk.[42] Active vulnerabilities, if distinguished from the other types, can be prioritized for patching.[40]
Mitigation
Vulnerability mitigation is measures that do not close the vulnerability, but make it more difficult to exploit or reduce the consequences of an attack.[43] Reducing the attack surface, particularly for parts of the system with root (administrator) access, and closing off opportunities for exploits to engage in privilege exploitation is a common strategy for reducing the harm that a cyberattack can cause.[37] If a patch for third-party software is unavailable, it may be possible to temporarily disable the software.[44]
Testing
A penetration test attempts to enter the system via an exploit to see if the system is insecure.[45] If a penetration test fails, it does not necessarily mean that the system is secure.[46] Some penetration tests can be conducted with automated software that tests against existing exploits for known vulnerabilities.[47] Other penetration tests are conducted by trained hackers. Many companies prefer to contract out this work as it simulates an outsider attack.[46]
Vulnerability lifecycle
The vulnerability lifecycle begins when vulnerabilities are introduced into hardware or software.[48] Detection of vulnerabilities can be by the software vendor, or by a third party. In the latter case, it is considered most ethical to immediately disclose the vulnerability to the vendor so it can be fixed.[49] Government or intelligence agencies buy vulnerabilities that have not been publicly disclosed and may use them in an attack, stockpile them, or notify the vendor.[50] As of 2013, the Five Eyes (United States, United Kingdom, Canada, Australia, and New Zealand) captured the plurality of the market and other significant purchasers included Russia, India, Brazil, Malaysia, Singapore, North Korea, and Iran.[51] Organized criminal groups also buy vulnerabilities, although they typically prefer exploit kits.[52]
Even vulnerabilities that are publicly known or patched are often exploitable for an extended period.
Vulnerabilities become deprecated when the software or vulnerable versions fall out of use.[49] This can take an extended period of time; in particular, industrial software may not be feasible to replace even if the manufacturer stops supporting it.[59]
Assessment, disclosure, and inventory
Assessment
A commonly used scale for assessing the severity of vulnerabilities is the open-source specification Common Vulnerability Scoring System (CVSS). CVSS evaluates the possibility to exploit the vulnerability and compromise data confidentiality, availability, and integrity. It also considers the how the vulnerability could be used and how complex an exploit would need to be. The amount of access needed for exploitation and whether it could take place without user interaction are also factored in to the overall score.[60][61]
Disclosure
Someone who discovers a vulnerability may disclose it immediately (
Vulnerability inventory
The most commonly used vulnerability dataset is Common Vulnerabilities and Exposures (CVE), maintained by Mitre Corporation.[68] As of 2023[update], it has over 20 million entries.[38] This information is shared into other databases, including the United States' National Vulnerability Database,[68] where each vulnerability is given a risk score using Common Vulnerability Scoring System (CVSS), Common Platform Enumeration (CPE) scheme, and Common Weakness Enumeration.[citation needed] CVE and other databases typically do not track vulnerabilities in software as a service products.[38] Submitting a CVE is voluntary for companies that discovered a vulnerability.[66]
Liability
The software vendor is usually not legally liable for the cost if a vulnerability is used in an attack, which creates an incentive to make cheaper but less secure software.
References
- ^ Ablon & Bogart 2017, p. 1.
- ^ a b c Ablon & Bogart 2017, p. 2.
- ^ Daswani & Elbayadi 2021, p. 25.
- ^ Seaman 2020, pp. 47–48.
- ^ Daswani & Elbayadi 2021, pp. 26–27.
- ^ Haber & Hibbert 2018, pp. 5–6.
- ^ Haber & Hibbert 2018, p. 6.
- ^ Haber & Hibbert 2018, p. 10.
- ^ Haber & Hibbert 2018, pp. 13–14.
- ISBN 978-0-12-374354-1.
- CiteSeerX 10.1.1.26.5435.
- ^ Linkov & Kott 2019, p. 2.
- ^ Haber & Hibbert 2018, p. 155.
- ^ Strout 2023, p. 17.
- ^ Haber & Hibbert 2018, p. 143.
- ^ Haber & Hibbert 2018, p. 141.
- ^ Haber & Hibbert 2018, p. 142.
- ^ Haber & Hibbert 2018, pp. 135–137.
- ^ Garg & Baliyan 2023, pp. 17–18.
- ^ a b Garg & Baliyan 2023, p. 17.
- ^ a b c Garg & Baliyan 2023, p. 18.
- ^ Salmani 2018, p. 1.
- ^ Salmani 2018, p. 11.
- ^ Garg & Baliyan 2023, pp. 20–25.
- ^ Sharp 2024, p. 271.
- ^ a b c Strout 2023, p. 15.
- ^ a b c d Strout 2023, p. 13.
- ^ Haber & Hibbert 2018, p. 129.
- ^ a b c d e Strout 2023, p. 14.
- ^ Strout 2023, pp. 14–15.
- ^ Agrafiotis et al. 2018, p. 2.
- ^ a b Haber & Hibbert 2018, pp. 97–98.
- ^ Tjoa et al. 2024, p. 63.
- ^ Tjoa et al. 2024, pp. 68, 70.
- ^ Magnusson 2020, p. 34.
- ^ Haber & Hibbert 2018, pp. 166–167.
- ^ a b c Haber & Hibbert 2018, p. 11.
- ^ a b c Strout 2023, p. 8.
- ^ Haber & Hibbert 2018, pp. 12–13.
- ^ a b Haber & Hibbert 2018, p. 84.
- ^ Haber & Hibbert 2018, p. 85.
- ^ Haber & Hibbert 2018, pp. 84–85.
- ^ Magnusson 2020, p. 32.
- ^ Magnusson 2020, p. 33.
- ^ Haber & Hibbert 2018, p. 93.
- ^ a b Haber & Hibbert 2018, p. 96.
- ^ Haber & Hibbert 2018, p. 94.
- ^ Strout 2023, p. 16.
- ^ a b Strout 2023, p. 18.
- ^ Libicki, Ablon & Webb 2015, p. 44.
- ^ Perlroth 2021, p. 145.
- ^ Libicki, Ablon & Webb 2015, pp. 44, 46.
- ^ Ablon & Bogart 2017, p. 8.
- ^ a b c d Sood & Enbody 2014, p. 42.
- ^ Strout 2023, p. 26.
- ^ Libicki, Ablon & Webb 2015, p. 50.
- ^ a b Libicki, Ablon & Webb 2015, pp. 49–50.
- ^ Strout 2023, p. 28.
- ^ Strout 2023, p. 19.
- ^ Strout 2023, pp. 5–6.
- ^ Haber & Hibbert 2018, pp. 73–74.
- ^ "Ask an Ethicist: Vulnerability Disclosure". Association for Computing Machinery's Committee on Professional Ethics. 17 July 2018. Retrieved 3 May 2024.
- ^ O'Harrow 2013, p. 18.
- ^ Libicki, Ablon & Webb 2015, p. 45.
- ^ Strout 2023, p. 36.
- ^ a b Haber & Hibbert 2018, p. 110.
- ^ Strout 2023, p. 22.
- ^ a b Strout 2023, p. 6.
- ^ Sloan & Warner 2019, pp. 104–105.
- ^ Haber & Hibbert 2018, p. 111.
Sources
- Ablon, Lillian; Bogart, Andy (2017). Zero Days, Thousands of Nights: The Life and Times of Zero-Day Vulnerabilities and Their Exploits (PDF). Rand Corporation. ISBN 978-0-8330-9761-3.
- Agrafiotis, Ioannis; Nurse, Jason R C; Goldsmith, Michael; Creese, Sadie; Upton, David (2018). "A taxonomy of cyber-harms: Defining the impacts of cyber-attacks and understanding how they propagate". Journal of Cybersecurity. 4 (1). ISSN 2057-2085.
- ISBN 978-1-4842-6654-0.
- Garg, Shivi; Baliyan, Niyati (2023). Mobile OS Vulnerabilities: Quantitative and Qualitative Analysis. CRC Press. ISBN 978-1-000-92451-0.
- Haber, Morey J.; Hibbert, Brad (2018). Asset Attack Vectors: Building Effective Vulnerability Management Strategies to Protect Organizations. Apress. ISBN 978-1-4842-3627-7.
- Libicki, Martin C.; Ablon, Lillian; Webb, Tim (2015). The Defender’s Dilemma: Charting a Course Toward Cybersecurity (PDF). Rand Corporation. ISBN 978-0-8330-8911-3.
- Linkov, Igor; Kott, Alexander (2019). "Fundamental Concepts of Cyber Resilience: Introduction and Overview". Cyber Resilience of Systems and Networks. Springer International Publishing. pp. 1–25. ISBN 978-3-319-77492-3.
- Magnusson, Andrew (2020). Practical Vulnerability Management: A Strategic Approach to Managing Cyber Risk. No Starch Press. ISBN 978-1-59327-989-9.
- O'Harrow, Robert (2013). Zero Day: The Threat In Cyberspace. Diversion Books. ISBN 978-1-938120-76-3.
- Perlroth, Nicole (2021). This Is How They Tell Me the World Ends: Winner of the FT & McKinsey Business Book of the Year Award 2021. Bloomsbury Publishing. ISBN 978-1-5266-2983-8.
- Salmani, Hassan (2018). Trusted Digital Circuits: Hardware Trojan Vulnerabilities, Prevention and Detection. Springer. ISBN 978-3-319-79081-7.
- Seaman, Jim (2020). PCI DSS: An Integrated Data Security Standard Guide. Apress. ISBN 978-1-4842-5808-8.
- Sharp, Robin (2024). Introduction to Cybersecurity: A Multidisciplinary Challenge. Springer Nature. ISBN 978-3-031-41463-3.
- Sloan, Robert H.; Warner, Richard (2019). Why Don't We Defend Better?: Data Breaches, Risk Management, and Public Policy. CRC Press. ISBN 978-1-351-12729-5.
- Sood, Aditya; Enbody, Richard (2014). Targeted Cyber Attacks: Multi-staged Attacks Driven by Exploits and Malware. Syngress. ISBN 978-0-12-800619-1.
- Strout, Benjamin (2023). The Vulnerability Researcher's Handbook: A comprehensive guide to discovering, reporting, and publishing security vulnerabilities. Packt Publishing. ISBN 978-1-80324-356-6.
- Tjoa, Simon; Gafić, Melisa; Kieseberg, Peter (2024). Cyber Resilience Fundamentals. Springer Nature. ISBN 978-3-031-52064-8.
External links
- Media related to Buidhe paid/Vulnerability (computing) at Wikimedia Commons