What is a security flaw?

Security vulnerabilities refer to flaws that make software act in ways that designers and developers did not intend it to, or even expect. Research in vulnerability analysis aims to improve ways of discovering vulnerabilities and making them public to prevent attackers from exploiting them.

The use of software has expanded into all aspects of our lives to the point that vulnerabilities have the potential to directly affect everyone. In the past, computer users might have been the only people that needed to worry about vulnerabilities. Today, anyone that uses smartphones, smart watches, smart TVs, or any other connected device or system is susceptible to having their information or property stolen. Even activities such as flying on an airplane, going to the hospital to get testing or medications, or using your credit cards are not completely secure. How can you protect yourself? In an environment where software is everywhere, opting out is simply not an option.

Vulnerabilities can also affect government agencies, industry, and critical infrastructure, such as power or water-treatment plants, local and federal government agencies, hospitals, banking institutions, and more. A successful attack against any of these entities could be catastrophic, resulting in massive data breaches or even injuries and death.

Today’s software-development environments create many easy opportunities for adversaries. Organizations must be constantly alert, working tirelessly to find and mitigate vulnerabilities that could affect them.

To reduce cybersecurity risk, SEI researchers conduct and promote coordinated vulnerability disclosure; research and publish vulnerability discovery methods and tools; work to improve vulnerability data and information systems; model vulnerability in technology ecosystems; research vulnerability presented by complicated supply chains; and model adversary behavior—all with the goal of helping organizations improve their knowledge and skills for defending their software and systems.

At the SEI, we’ve been working to help keep organizations and the public informed about vulnerabilities for almost 30 years. In 1988, we published our first advisory on vulnerabilities that were exploited by the Morris worm, which was one of the first types of malware to successfully replicate widely over the Internet, causing widespread damage.

Since then, we have worked on many vulnerability reports, and we often consult with software vendors about releasing patches and fixes. The CERT Division of the SEI notifies the public of vulnerabilities, providing detailed technical information and mitigation strategies via CERT Vulnerability Notes, which propagate to the National Institute of Standards and Technology (NIST) National Vulnerability Database (NVD). Recently, the CERT Coordination Center (CERT/CC) rolled out a new, web-based platform for software vulnerability reporting and coordination called the Vulnerability Information and Coordination Environment (VINCE). VINCE helps scale communications and increase the level of direct collaboration between vulnerability reporters, coordinators, and software vendors, aiding the vendor to provide a fix or patch.

We are also closely involved in working on standards and policy development, process engineering, and outreach. Our work on disclosures is transferred to the U.S. Department of Defense (DoD), as well as other organizations. CERT researchers analyze vulnerability data, collaborate with others to improve information exchange, and interface with external standards groups such as the NIST, NVD, and Common Vulnerability and Exposures (CVE) system to enhance data formats or exchange protocols. Beyond our work with security defects in deployed software, we also perform vulnerability discovery to catch defects early in the development lifecycle and develop downloadable vulnerability discovery and analysis tools.

Understanding vulnerabilities in embedded and connected software-reliant systems—including cars, implanted medical devices, airplanes, industrial control systems, and emerging domains—is key to the future of defending against security vulnerabilities. To proactively identify, assess, and resolve new risks, SEI researchers will continue to work on advancing tools and methodologies. As new attackers continue to discover and exploit new security vulnerabilities, and as the complexity of attacks increase, the SEI’s research will continue to respond to improve the strength of our defenses.

Read our wiki to learn more.

Learn More

  Weakness in an information system, system security procedures, internal controls, or implementation that could be exploited or triggered by a threat source.
Source(s):
FIPS 200 under VULNERABILITY from CNSSI 4009 - Adapted
NIST SP 1800-15B under Vulnerability from NIST SP 800-37 Rev. 2
NIST SP 1800-15C under Vulnerability from NIST SP 800-37 Rev. 2
NIST SP 1800-25B under Vulnerability from FIPS 200, CNSSI 4009-2015 - Adapted
NIST SP 1800-26B under Vulnerability from FIPS 200, CNSSI 4009-2015 - Adapted
NIST SP 1800-27B under Vulnerability from FIPS 200
NIST SP 800-128 under Vulnerability from CNSSI 4009 - Adapted
NIST SP 800-137 under Vulnerability from CNSSI 4009
NIST SP 800-161r1 from NIST SP 800-53 Rev. 5
NIST SP 800-18 Rev. 1 under Vulnerability from CNSSI 4009 - Adapted
NIST SP 800-53 Rev. 5 from NIST SP 800-30 Rev. 1
NIST SP 800-53A Rev. 5 from NIST SP 800-30 Rev. 1
NIST SP 800-60 Vol. 1 Rev. 1 under Vulnerability from CNSSI 4009 - Adapted
NIST SP 800-60 Vol. 2 Rev. 1 under Vulnerability from CNSSI 4009 - Adapted
NIST SP 800-82 Rev. 2 under Vulnerability
NISTIR 7621 Rev. 1 under Vulnerability
NISTIR 7622 under Vulnerability from FIPS 200, NIST SP 800-115

  Weakness in a system, system security procedures, internal controls, or implementation that could be exploited or triggered by a threat.
Source(s):
NIST SP 1800-17b under Vulnerability
NIST SP 800-160 Vol. 1 from CNSSI 4009 - Adapted

  Weakness in an information system, system security procedures, internal controls, or implementation that could be exploited by a threat source.
Source(s):
CNSSI 4009-2015 from NIST SP 800-30 Rev. 1
NIST SP 1800-21B under Vulnerability from NIST SP 800-30 Rev. 1
NIST SP 800-12 Rev. 1 under Vulnerability from NIST SP 800-30 Rev. 1
NIST SP 800-30 Rev. 1 under Vulnerability from CNSSI 4009
NIST SP 800-39 under Vulnerability from CNSSI 4009
NISTIR 8011 Vol. 4 from CNSSI 4009-2015

  Weakness in an information system, system security procedures, internal controls, or implementation that could be exploited or triggered by a threat source. Note: The term weakness is synonymous for deficiency. Weakness may result in security and/or privacy risks.
Source(s):
NIST SP 800-128 from CNSSI 4009-2015 - Adapted

  Weakness in an information system, or in system security procedures, internal controls, or implementation, that could be exploited or triggered by a threat source.
Source(s):
NIST SP 800-115 under Vulnerability

  a flaw or weakness that may allow harm to occur to an IT system or activity.
Source(s):
NIST SP 800-16 under Vulnerability

  A flaw or weakness in a computer system, its security procedures, internal controls, or design and implementation, which could be exploited to violate the system security policy.
Source(s):
NIST SP 800-28 Version 2 under Vulnerability

  A security exposure in an operating system or other system software or application software component. A variety of organizations maintain publicly accessible databases of vulnerabilities based on the version numbers of software. Each vulnerability can potentially compromise the system or network if exploited.
Source(s):
NIST SP 800-44 Version 2 under Vulnerability
NIST SP 800-45 Version 2 under Vulnerability

  A weakness in a system, application, or network that is subject to exploitation or misuse.
Source(s):
NIST SP 800-61 Rev. 2 under Vulnerability

  Weakness in an information system, system security procedures, internal controls, or implementation that could be exploited or triggered by a threat source. Note: the term weakness is synonymous for defiency. Weakness may result in security and /or privacy risks.
Source(s):
NIST SP 800-37 Rev. 2

  A weakness in system security procedures, system design, implementation, internal controls, etc., that could be exploited to violate the system security policy.
Source(s):
NISTIR 4734 under Vulnerability

  a bug, flaw, weakness, or exposure of an application, system, device, or service that could lead to a failure of confidentiality, integrity, or availability
Source(s):
NISTIR 7435 under Vulnerability

  An error, flaw, or mistake in computer software that permits or causes an unintended behavior to occur. CVE is a common means of enumerating vulnerabilities.
Source(s):
NISTIR 7511 Rev. 4 under Vulnerability

  A weakness in system security procedures, hardware, design, implementation, internal controls, technical controls, physical controls, or other controls that could be accidentally triggered or intentionally exploited and result in a violation of the system's security policy.
Source(s):
NISTIR 7316 under Vulnerability

  A condition that enables a threat event to occur.
Source(s):
NISTIR 8286 under Vulnerability

  A weakness in an information system, system security procedures, internal controls, or implementation that could be exploited or triggered by a threat source.
Source(s):
NISTIR 8323 under Vulnerability from NIST SP 800-30 Rev. 1

Q&A What

What is a security flaw?

Postagens relacionadas

Publicidade

ÚLTIMAS NOTÍCIAS

Toplistas

Publicidade

Populer

Publicidade

Sobre

Jurídica

Ajuda

Social