Vulnerability, Risk and Threat

When it comes to cybersecurity, it's important to understand the difference between vulnerability, risk and threat. They're often confused or used interchangeably, but they're actually three different concepts.

 What Is a Vulnerability?

A vulnerability is a weakness in security that can be exploited by a threat. For example, if you have a password that's easy to guess, that's a vulnerability.

If you're using an outdated version of software, that's a vulnerability. If your firewall isn't up-to-date, that's a vulnerability. Basically, any flaw in your security can be exploited by a hacker and turn into a risk.

That's why it's so important to stay on top of your security and make sure all your systems are patched and up-to-date. The last thing you want is for your business to be vulnerable to attack.

Some common vulnerabilities are listed below

 1. Zero-day 

When an organization or software provider is not aware of a security hole that has been found by a threat actor yet is referred to as a zero-day vulnerability. The phrase "zero-day" refers to a software vulnerability that the vendor was not aware of and for which they had "0" days to develop a security patch or update to address the problem, despite the fact that the attacker was aware of it.

Because they may be incredibly hard to identify, zero-day attacks are particularly risky for businesses. A coordinated defense, one that comprises both preventative technologies and an extensive reaction strategy in the event of a cyberattack, is required to successfully identify and neutralize zero-day assaults. By implementing a comprehensive endpoint security solution that incorporates technologies such as next-gen antivirus (NGAV), endpoint detection and response (EDR), and threat intelligence, organizations may get ready for these sneaky and harmful incidents.

 2. Unsecured APIs

Application programming interfaces that are not protected are another typical security flaw (APIs). APIs offer a digital interface that permits communication between apps or parts of applications via the internet or over a private network. One of the rare corporate assets having a public IP address is an API. They can become an easy target for attackers to infiltrate if not properly and sufficiently guarded.

API security is a procedure that is prone to human mistake. IT staff may simply be ignorant of the special security risk this asset has and depend on regular security procedures, despite the fact that hostile behavior is extremely unusual. Just like in a conventional setting, conducting a security awareness training to inform teams on security practices related to the cloud is essential. These include how to keep secrets, how to rotate keys, and how to practice good IT hygiene during software development.

For more information you can check out OWASP top 10 which is a standard awareness guide for web app security 
Link : https://owasp.org/www-project-top-ten/

You can also check Common Vulnerabilities and Exposures
It is a database of publicly disclosed information security issues.
To learn more about CVE please check cve.org
Link : https://www.cve.org/About/Overview

 What Is a Risk? 

A risk is the potential for harm that's associated with a vulnerability. So if a hacker exploits a vulnerability in your system, they could potentially gain access to your data or damage your network.

And lastly, we have threat. A threat is an action or event that could lead to a risk becoming realized. For example, an attack by a hacker is a threat to your system security.

General formula to calculate risk : 

 Risk = Likelihood x Impact 

Identifying, analyzing, evaluating, and resolving the cyber security hazards to your company is known as cyber risk management.

A cyber risk assessment is the first step in the process of managing the risk associated with cyber security. This risk assessment will give you a quick overview of the threats to the cyber security of your company and their potential severity.

Here are some standards and frameworks that implement cyber risk management

 1. ISO27001 

ISO-27001 is part of a set of standards developed to handle information security: the ISO/IEC 27000 series.

Not only does the standard give businesses the knowledge they need to protect their most precious data, but a business can also become certified against ISO 27001 and, in this way, demonstrate to its clients and business partners that it is committed to securing their data.

Additionally, individuals can demonstrate their qualifications to future employers by becoming ISO 27001-certified through the completion of a course and exam.

Since ISO 27001 is an international standard, it is widely accepted, which expands commercial potential for businesses and individuals.

 2. PCIDSS 

Payment Card Industry Data Security Standard is a set of security requirements created to guarantee that ALL businesses that take, process, store, or transmit credit card information do so in a secure manner.

As per PCI Compliance Standards, organizations are required to conduct internal and external PCI scanning quarterly or every 90 days. 

4 PCIDSS compliance levels are mentioned below.

1. Businesses that handle more than 6 million card transactions yearly. 
2. Businesses that handle between one and six million transactions yearly.
3. Businesses doing 20,000–1,000,000 transactions annually.
4. Merchants that execute fewer than 20,000 transactions annually are classified as Level 4.

 What Is a Threat? 

Any situation or occurrence that may negatively affect an organization's operations, assets, users, other organizations, or the country through the use of a system, whether through illegal access, information deletion, disclosure, modification, or denial of service is a Threat.  

It is a possible danger that could exploit a vulnerability and cause harm to an information system. For example, a threat actor could be a hacker who is trying to access data that they shouldn't have access to.

Another example of a threat actor could be someone who is trying to crash a computer system or deliberately delete files. Basically, any malicious act that could harm an information system is considered a threat.

Some common threats are listed below

 1. Spyware 

It is malicious software that infiltrates a user's computer, collects information about the user and the device, and then distributes it to other parties without the user's knowledge or agreement. A piece of malware created to access and harm a device without the user's permission is typically understood as spyware.

Spyware gathers private and sensitive data that it sells to advertising, data gathering companies, or unscrupulous individuals in order to make money. Attackers use it to trace, take, and sell user information such internet activity patterns, credit card numbers, and bank account information, as well as to steal user credentials to impersonate users.

Examples : adware, keyloggers, rootkit, red shell

 2. Advance Persistent Threats 

An advanced persistent threat (APT) is one that uses persistent, covert, and sophisticated hacking techniques to enter a system and stay there for an extended length of time with potentially harmful effects, as the label "advanced" suggests.

Stage 1 : Gain Access

Stage 2 : Establish a Foothold

Stage 3 : Deepen Access

Stage 4 : Move Laterally

Stage 5 : Look, Learn, and Remain

APTs are typically directed at high value targets, such as nation states and major corporations, due to the level of effort required to carry out such an attack. The ultimate goal of these attacks is to steal information over an extended period of time, as opposed to "dipping in" and leaving quickly, as many black hat hackers do during lower level cyber assaults.

Businesses everywhere should be aware of the APT assault technique. Small- and medium-sized firms should not disregard this kind of attack, though.

In order to reach major enterprises, APT attackers are increasingly leveraging smaller businesses that are a part of their target organization's supply chain. They employ these businesses as stepping stones because they are often less well-defended.

Conclusion

Threat is what poses a danger to an organization, such as a hacker installing a malware to steal data. 

Risk is what could happen as a result of that threat, such as the theft of customer data.

And vulnerability is the weakness that can be exploited and it tells us how at risk an organization is with respect to a particular threat.