Scribd Logo
Upload

Welcome to Scribd!

  • 76 views

    Here Are 9 Types of Security Vulnerabilities

    Uploaded by

    Florick Le Mahamat
    The document discusses nine types of security vulnerabilities that can be exploited by threat actors: 1) unpatched software, 2) misconfigurations, 3) weak credentials, 4) compromised credentials, 5) trust relationships, 6) missing or poor encryption, 7) phishing, web attacks, and ransomware, 8) zero-days and unknown methods, and 9) malicious insiders. It explains how each vulnerability can be exploited to perform unauthorized actions. The document promotes Balbix as a tool that can automatically and continuously assess an organization's risk across all nine vulnerability classes to provide prioritized security insights.

    Copyright:

    © All Rights Reserved
    Download as PDF, TXT or read online from Scribd

    Here Are 9 Types of Security Vulnerabilities

    Uploaded by

    Florick Le Mahamat
    76 views1 page
    The document discusses nine types of security vulnerabilities that can be exploited by threat actors: 1) unpatched software, 2) misconfigurations, 3) weak credentials, 4) compromised credentials, 5) trust relationships, 6) missing or poor encryption, 7) phishing, web attacks, and ransomware, 8) zero-days and unknown methods, and 9) malicious insiders. It explains how each vulnerability can be exploited to perform unauthorized actions. The document promotes Balbix as a tool that can automatically and continuously assess an organization's risk across all nine vulnerability classes to provide prioritized security insights.

    Original Title

    9_Types_of_Security_Vulnerabilities_1596296310

    Copyright

    © © All Rights Reserved

    Available Formats

    PDF, TXT or read online from Scribd

    Did you find this document useful?

    Is this content inappropriate?

    The document discusses nine types of security vulnerabilities that can be exploited by threat actors: 1) unpatched software, 2) misconfigurations, 3) weak credentials, 4) compromised credentials, 5) trust relationships, 6) missing or poor encryption, 7) phishing, web attacks, and ransomware, 8) zero-days and unknown methods, and 9) malicious insiders. It explains how each vulnerability can be exploited to perform unauthorized actions. The document promotes Balbix as a tool that can automatically and continuously assess an organization's risk across all nine vulnerability classes to provide prioritized security insights.

    Copyright:

    © All Rights Reserved
    Download as PDF, TXT or read online from Scribd
    Download as pdf or txt
    76 views1 page

    Here Are 9 Types of Security Vulnerabilities

    Uploaded by

    Florick Le Mahamat
    The document discusses nine types of security vulnerabilities that can be exploited by threat actors: 1) unpatched software, 2) misconfigurations, 3) weak credentials, 4) compromised credentials, 5) trust relationships, 6) missing or poor encryption, 7) phishing, web attacks, and ransomware, 8) zero-days and unknown methods, and 9) malicious insiders. It explains how each vulnerability can be exploited to perform unauthorized actions. The document promotes Balbix as a tool that can automatically and continuously assess an organization's risk across all nine vulnerability classes to provide prioritized security insights.

    Copyright:

    © All Rights Reserved
    Download as PDF, TXT or read online from Scribd
    Download as pdf or txt
    of 1

    OF SECURITY

    VULNERABILITIES

    SECURITY VULNERABILITY:
    A WEAKNESS WHICH CAN BE EXPLOITED BY Vulnerability is a very broad
    A THREAT ACTOR, SUCH AS AN ATTACKER,
    term. Yet somehow, in infosec,
    TO PERFORM UNAUTHORIZED ACTIONS WITHIN
    A COMPUTER SYSTEM. we’ve come to narrowly
    TO EXPLOIT A VULNERABILITY, AN ATTACKER associate a vulnerability
    MUST HAVE AT LEAST ONE APPLICABLE TOOL
    with unpatched software
    OR TECHNIQUE THAT CAN CONNECT TO
    A SYSTEM WEAKNESS. and misconfigurations.

    HERE ARE 9 TYPES OF SECURITY VULNERABILITIES


    UNPATCHED SOFTWARE COMPROMISED CREDENTIALS
    Unpatched vulnerabilities allow An attacker can use compromised
    attackers to run a malicious code credentials to gain unauthorized
    by leveraging a known security bug access to a system in your network.
    that has not been patched. The adversary will The adversary will try to some-how intercept
    try to probe your environment looking for and extract passwords from unencrypted
    unpatched systems, and then attack them or incorrectly encrypted communication
    directly or indirectly. between your systems, or from unsecured
    handling by software or users. The adversary
    MISCONFIGURATION may also exploit reuse of passwords across
    System misconfigurations (e.g. different systems.
    assets running unnecessary
    services, or with vulnerable settings TRUST RELATIONSHIP
    such as unchanged defaults) can be exploited Attackers can exploit trust
    by attackers to breach your network. The configurations that have been set
    adversary will try to probe your environment up to permit or simplify access
    looking for systems that can be compromised between systems (e.g. mounted drives, remote
    due to some misconfiguration, and then attack services) to propagate across your network.
    them directly or indirectly. The adversary, after gaining access to a
    system, can then proceed to breach other
    WEAK CREDENTIALS systems that implicitly trust the originally
    An attacker may use dictionary or compromised system.
    brute force attacks to attempt to
    guess weak passwords, which can MISSING/POOR ENCRYPTION
    then be used to gain access to systems in With attacks on Missing/Poor
    your network. Encryption, an attacker can
    intercept communication between
    PHISHING, WEB systems in your network and steal information.
    & RANSOMWARE The attacker can intercept unencrypted or
    Phishing is used by attackers to poorly encrypted information and can then
    get users to inadvertently execute extract critical information, impersonate either
    some malicious code, and thereby compromise side and possibly inject false information into
    a system, account or session. The adversary the communication between systems.
    will send your users a link or malicious
    attachment over email (or other messaging ZERO-DAYS &
    system), often alongside some text/image UNKNOWN METHODS
    that entices them to click. Zero days are specific software
    vulnerabilities known to the
    MALICIOUS INSIDER adversary but for which no fix is available,
    An employee or a vendor who often because the bug has not been reported
    might have access to your critical to the vendor of the vulnerable system. The
    systems can decide to exploit their adversary will try to probe your environment
    access to steal or destroy information or impair looking for systems that can be compromised
    them. This is particularly important for by the zero day exploit they have, and then
    privileged users and critical systems. attack them directly or indirectly.

    Balbix looks at all 9 classes of


    vulnerabilities, automatically
    and continuously calculating
    likelihood of breach via each
    class for every asset on your
    network. The result is mapped
    to the Balbix Breach Method
    matrix, and used as part of
    the risk calculation score that
    feeds actionable, prioritized
    insights to help your team
    maximize cyber resilience. LEARN MORE about how Balbix can help.

    AL-POWERED CYBERSECURITY POSTURE TRANSFORMATION

    You might also like