Subject: [sacm] SACM Terminology - Vulnerability

From: "Waltermire, David A." <[email-masked]>
Date: Mon, 19 Aug 2013 00:05:03 +0000

There are many terms in this space that are overloaded with meaning to the point that the terms are less than useful (e.g., asset, vulnerability, policy). For these terms, it might be best to use more specific terms in our documents as a general practice.  Here are some vulnerability-related terms with potential definitions from various sources:

Comments/preferences/alternate definitions are appreciated.

Dave

Vulnerability:
----------------
A vulnerability is a state of configuration or defect in a system which allows an unintended and unauthorized party to violate the security or policies of the system. (from Chris Inacio)

A weakness in an information system, system security procedures, internal controls, or implementation that is subject to exploitation or misuse. This includes flaws in software and processes, and misconfiguration of hardware or software. (derived from NIST definitions)

>From RFC4949:

(I) A flaw or weakness in a system's design, implementation, or

      operation and management that could be exploited to violate the

      system's security policy. (See: harden.)

      Tutorial: A system can have three types of vulnerabilities: (a)

      vulnerabilities in design or specification; (b) vulnerabilities in

      implementation; and (c) vulnerabilities in operation and

      management. Most systems have one or more vulnerabilities, but

      this does not mean that the systems are too flawed to use. Not

      every threat results in an attack, and not every attack succeeds.

      Success depends on the degree of vulnerability, the strength of

      attacks, and the effectiveness of any countermeasures in use. If

      the attacks needed to exploit a vulnerability are very difficult

      to carry out, then the vulnerability may be tolerable. If the

      perceived benefit to an attacker is small, then even an easily

      exploited vulnerability may be tolerable. However, if the attacks

      are well understood and easily made, and if the vulnerable system

      is employed by a wide range of users, then it is likely that there

      will be enough motivation for someone to launch an attack.

* Software flaw:

A weakness in software that is subject to exploitation or misuse. A software flaw can be used by an attacker to gain access to a system or network, and/or materially affect the confidentiality, integrity or availability of information hosted by an endpoint or exchanged over a network. Such a flaw may allow an attacker to execute commands as another user, access data that is contrary to specified access controls, pose as another entity, or to conduct a denial of service. (derived from CVE vulnerability definition)

* Misconfiguration:

A misconfiguration is a configuration setting that violates organizational security policies, introduces a possible security weakness in a system, or permits or causes unintended behavior that may impact the security posture of a system. (from NIST IR 7670)

The misalignment of a unit of endpoint configuration posture relative to organizational expectations that is subject to exploitation or misuse.

* Exposure:

An endpoint misconfiguration or software flaw that allows access to information or capabilities that can be used by an attacker as a means to compromise  an endpoint or network. (derived from CVE exposure definition)

>From RFC4949:

(I) A type of threat action whereby sensitive data is directly

      released to an unauthorized entity. (See: unauthorized

      disclosure.)

      Usage: This type of threat action includes the following subtypes:

      -  "Deliberate Exposure": Intentional release of sensitive data to

         an unauthorized entity.

      -  "Scavenging": Searching through data residue in a system to

         gain unauthorized knowledge of sensitive data.

      -  "Human error": /exposure/ Human action or inaction that

         unintentionally results in an entity gaining unauthorized

         knowledge of sensitive data. (Compare: corruption,

         incapacitation.)

      -  "Hardware or software error": /exposure/ System failure that

         unintentionally results in an entity gaining unauthorized

         knowledge of sensitive data. (Compare: corruption,

         incapacitation.)

Vulnerability Management:
----------------------------------
The process of mitigating the ability to exploit a vulnerability, via defect removal or protective measures such that exploitation becomes impossible or highly unlikely. (from Chris Inacio)

Remediation (sometimes the term "remedy" is less contentious):

-------------------------------------------------------------------------------

A remediation is defined as a security-related set of actions that results in a change to a computer's state and may consist of changes motivated by the need to enforce organizational security policies, address discovered vulnerabilities, or correct misconfigurations. (from NIST IR 7670)