Security concerns related to vulnerabilities

Question 1

What is Cloud-based vs. on-premises vulnerabilities

Answer 1

An application vulnerability is a design flaw that can cause the security system to be circumvented or that will cause the application to crash.

On-premises risks refer to software vulnerabilities, weak configurations, and third-party issues arising from hosts, servers, routers, switches, access points, and firewalls located on a private network installed to private offices or campus buildings. Many companies use cloud services to fully or partly support business workflows. The third-party vendor management, code, and data storage risks discussed previously apply directly to cloud as well as to on-premises. Software and weak configuration risks can also apply, however. They are not the sole responsibility of the cloud service provider (CSP). Clouds operate a shared responsibility model. This means that the cloud service provider is responsible for the security of the cloud, while the cloud consumer is responsible for security in the cloud. The types of software and configuration vulnerabilities that you must assess and monitor vary according to the nature of the service.

Question 2

What is Zero-day

Answer 2

A vulnerability in software that is unpatched by the developer or an attack that exploits such a vulnerability.

Question 3

What is Weak configurations

Answer 3

Open Permissions
Unsecure root account
Errors
Weak encryption
Unsecure protocols
Default settings
Open ports and services

Question 4

What is Open permissions

Answer 4

Open permissions refers to provisioning data files or applications without differentiating access rights for user groups.

Question 5

What is Unsecure root accounts

Answer 5

The root account, referred to as the default Administrator account in Windows or generically as the superuser, has no restrictions set over system access. A superuser account is used to install the OS. An unsecured root account is one that an adversary is able to gain control of, either by guessing a weak password or by using some local boot attack to set or change the password.

Question 6

What is Errors

Answer 6

Weakly configured applications may display unformatted error messages under certain conditions. These error messages can be revealing to threat actors probing for vulnerabilities and coding mistakes. Secure coding practices should ensure that if an application fails, it does so “gracefully” without revealing information that could assist the development of an exploit.

Question 7

What is Weak encryption

Answer 7

Encryption algorithms protect data when it is stored on disk or transferred over a network. Encrypted data should only be accessible to someone with the correct decryption key.

Question 8

What is Unsecure protocols

Answer 8

An unsecure protocol is one that transfers data as cleartext; that is, the protocol does not use encryption for data protection. Lack of encryption also means that there is no secure way to authenticate the endpoints. This allows an attacker to intercept and modify communications, acting as man-in-the-middle (MITM).

Question 9

What is Default settings

Answer 9

Relying on the manufacturer default settings when deploying an appliance or software applications is one example of weak configuration. It is not sufficient to rely on the vendor to ship products in a default-secure configuration, though many now do. Default settings may leave unsecure interfaces enabled that allow an attacker to compromise the device. Network appliances with weak settings can allow attackers to move through the network unhindered and snoop on traffic.

Question 10

What is Open ports and services

Answer 10

Network applications and services allow client connections via Transport Control Protocol (TCP) or User Datagram Protocol (UDP) port numbers. The clients and servers are identified by Internet Prototocol (IP) addresses. Servers must operate with at least some open ports, but security best practice dictates that these should be restricted to only necessary services. Running unnecessary open ports and services increases the attack surface.

Question 11

What is Third-party risks

Answer 11

Vendor management
System integration
Lack of vendor support
Supply Chain
Outsourced code development
Data storage

Question 12

What is Vendor management

Answer 12

Policies and procedures to identify vulnerabilities and ensure security of the supply chain.

Is a process for selecting supplier companies and evaluating the risks inherent in relying on a third-party product or service.

Question 13

What is System integration

Answer 13

System integration refers to the process of using components/services from multiple vendors to implement a business workflow.

Question 14

What is Lack of vendor support

Answer 14

The vendor for a variety of reasons has ceased providing a good service or failed to provide good service or security.

Question 15

What is Supply chain

Answer 15

A supply chain is a network between a company and its suppliers to produce and distribute a specific product to the final buyer.

Question 16

What is Outsourced code development

Answer 16

The problem of effective oversight is particularly pertinent to outsourced code development. Many companies do not have in-house programming expertise, but without such expertise it is hard to ensure that contractors are delivering secure code. A solution is to use one vendor for development and a different vendor for vulnerability and penetration testing.

Question 17

What is Data storage

Answer 17

There are two main scenarios for risks to data when using third parties. First, you may need to grant vendor access to your data, and second, you may use a vendor to host data or data backups and archives.

Question 18

What is Improper or weak patch management

Answer 18

FirmWare
Operating Systems
Applications

Question 19

What is Firmware

Answer 19

Firmware—vulnerabilities can exist in the BIOS/UEFI firmware that controls the boot process for PCs. There can also be bugs in device firmware, such as network cards and disk controllers. Finally, network appliances and Internet of Things (IoT) devices run OS code as a type of firmware. Like kernel vulnerabilities, firmware exploits can be difficult to identify, because the exploit code can run with the highest level of privilege.

Question 20

What is Operating system (OS)

Answer 20

Operating system (OS)—an application exploit will run with the permissions of the logged on user, which will hopefully be limited. A vulnerability in an OS kernel file or shared library is more likely to allow privilege escalation, where the malware code runs with higher access rights (system or root).

Question 21

What is Applications

Answer 21

An application vulnerability is a design flaw that can cause the security system to be circumvented or that will cause the application to crash.

Question 22

What is Legacy platforms

Answer 22

A legacy platform is one that is no longer supported with security patches by its developer or vendor.

Question 23

What is Impacts

Answer 23

Data loss
Data breaches
Data exfiltration
Identity theft
Financial
Reputation
Availability loss

Question 24

What is Data loss

Answer 24

Data loss is where information becomes unavailable, either permanently or temporarily.

Question 25

What is Data breaches

Answer 25

A data breach event is where confidential data is read or transferred without authorization. A privacy breach is where personal data is not collected, stored, or processed in full compliance with the laws or regulations governing personal information. A breach can also be described as a data leak. A data breach can be intentional/malicious or unintentional/accidental.

Question 26

What is Data exfiltration

Answer 26

Data exfiltration is the methods and tools by which an attacker transfers data without authorization from the victim’s systems to an external network or media. Unlike a data breach, a data exfiltration event is always intentional and malicious. A data breach is a consequence of a data exfiltration event.

Question 27

What is Identity theft

Answer 27

A privacy breach may allow the threat actor to perform identity theft or to sell the data to other malicious actors. The threat actor may obtain account credentials or might be able to use personal details and financial information to make fraudulent credit applications and purchases.

Question 28

What is Financial

Answer 28

All these impacts can have direct financial impacts due to damages, fines, and loss of business.

Question 29

What is Reputation

Answer 29

Major events might cause widespread adverse publicity on social media and mainstream media. In anticipation of these impacts, incident handling teams should include public relations (PR) and marketing expertise to minimize reputational damage.

Question 30

What is Availability loss

Answer 30

Availability is sometimes overlooked as a security attribute compared to confidentiality and integrity, but it can have severe impacts on business workflows. If processing systems are brought down by accidental or malicious disaster events, a company may not be able to perform crucial workflows like order processing and fulfillment.