Contents
Why are security vulnerabilities not that simple to fix?
A scanner finds a vulnerability on a given system, yet the security team had no idea that the system in question even existed on the company’s network, let alone who owns that system. The issue is a result of asset inventory being incomplete or out of date, which is, unfortunately, a very common scenario.
Which is the most insidious cyber security vulnerability?
Security Misconfiguration is one of most insidious vulnerabilities that could affect basically every technology, including web services, client applications, electronic equipment, Internet of Things devices, and encryption mechanisms. Applications and systems that have been misconfigured result open to cyber-attacks.
Are there any vulnerabilities that do not require access to the intranet?
There are still web-based vulnerabilities which do not require access to the intranet at all, specifically reflected XSS and CSRF. If you take the same approach of not updating with web applications as you take with web servers, it is fair to assume that some applications will be vulnerable.
How can a vulnerability be exploited by an attacker?
The scanner uncovers a vulnerability in the server’s operating system (OS); however, the vulnerability can only be exploited by an attacker if a certain function is enabled. The scanner cannot determine whether the organization’s environment has that function enabled, but it still flags the vulnerability.
What happens in between scanning and patching a vulnerability?
It sounds simple: A scanner identifies a vulnerability, the vulnerability is patched. What happens in between, however, can be far from simple. Yet if you are not on a security team or, more specifically, a vulnerability management team, you would never know the bumpy, winding road that often stretches between scanning and patching.
Is it illegal to report a security vulnerability?
There is a significant risk that you will be prosecuted for hacking or for extortion if you try to demand compensation for reporting the vulnerability. Note that in the US, hacking is illegal. The law is extremely broad and prohibits all sorts of things that many people might not realize are illegal.