🔓Vulnerability

NEW

Also known as: Security Flaw, Security Risk

A weakness in an information system, process, or control that attackers can exploit to compromise confidentiality, integrity, or availability.

DESCRIPTION

Vulnerabilities expose systems to exploitation by threats. They arise from coding errors, misconfigurations, outdated dependencies, or weak processes. Catalogs like CVE standardize identification for remediation. Organizations manage vulnerabilities via scanning, prioritization, patching, and secure development practices. Risk assessments weigh likelihood and impact to guide response. Governance and compliance frameworks require timely mitigation. Continuous monitoring and DevSecOps reduce exposure throughout the lifecycle.

ALTERNATIVE DEFINITIONS

NIST

Weakness in an information system, system security procedures, internal controls, or implementation that could be exploited or triggered by a threat source.

Formal regulatory-style definition across systems and procedures.

Source

OWASP

A vulnerability is a weakness in a system that can be exploited to cause damage or compromise security.

Developer-focused emphasis on exploitability and impact.

Source

RELATED TERMS

Threat Attack Surface Patch Management CVE Risk Assessment Control Penetration Testing Secure Coding

COMPETING TERMS

Exploit Mitigation

KNOWLEDGE AREAS

Data Security Data Privacy & Compliance

TARGET AUDIENCE

DevOps Engineer Software Developer Cloud Architect Data Governance Manager Chief Technology Officer Chief Information Officer

EXTERNAL SOURCES

• Wikipedia - Vulnerability (computing)
• MITRE - CVE vulnerability identification system
• NIST NVD - National Vulnerability Database
• OWASP - Top Ten web app risks

TOP QUESTIONS

What is a Vulnerability in computing?

It is a weakness in systems, controls, or processes that attackers can exploit to harm confidentiality, integrity, or availability.

Category: Definition

How are Vulnerabilities discovered?

Through code reviews, static/dynamic analysis, penetration testing, bug bounties, and continuous scanning of infrastructure and dependencies.

Category: HowTo

What is CVE and why is it important to Vulnerability management?

CVE assigns standardized identifiers to publicly known vulnerabilities, enabling consistent tracking and remediation across tools and organizations.

Category: Concepts

What are common mistakes around Vulnerabilities?

Delayed patching, ignoring dependency risks, misconfigurations in cloud IAM, and insufficient input validation are persistent errors.

Category: Mistakes

What are the risks of ignoring Vulnerabilities?

Breaches, data loss, service outages, reputational damage, and regulatory penalties can result from exploitation of unaddressed weaknesses.

Category: Risks

How is Vulnerability management structured?

Identify, assess, prioritize, remediate, and verify. Governance sets policies; DevSecOps automates detection and patch pipelines.

Category: Management

How do standards relate to Vulnerabilities?

Frameworks like ISO 27001 and NIST 800-53 mandate controls that reduce vulnerabilities and require periodic assessment and remediation.

Category: Standard

What is the biggest misunderstanding about Vulnerabilities?

They are not just code bugs; process and configuration weaknesses are equally critical and often easier for attackers to exploit.

Category: Misunderstanding

Where to start improving Vulnerability management?

Establish asset inventory, automate scanning, prioritize by exploitability and impact, patch promptly, and track metrics like mean time to remediate.

Category: GettingStarted