What is a vulnerability?¶
A vulnerability is a weakness in software, hardware, configuration, process or design that may allow unintended or unauthorised activity.
Avoid the dangerous assumption¶
The dangerous assumption is that a vulnerability is the same as an exploit or a proven compromise.
It is not.
A vulnerability may involve:
- a software flaw
- an insecure default
- weak authentication
- excessive permissions
- an exposed service
- poor isolation
- an unprotected interface
- a process weakness
- human or organisational behaviour.
Some vulnerabilities are publicly documented and assigned identifiers. Others are configuration-specific or unknown to the vendor at the time.
Investigators should establish:
- what component was vulnerable
- which version or configuration was affected
- what preconditions were required
- what access the weakness could provide
- whether the weakness existed at the relevant time
- whether there is evidence it was actually used.
A vulnerability can explain how access may have been possible. It does not prove that access occurred.
A system may remain vulnerable for years without exploitation. Conversely, a system may be compromised through another route even after a vulnerability is identified.
Do not assume the presence of a patch proves earlier exploitation. A patch may have been applied as a precaution.
Likewise, the absence of a patch does not by itself identify the point of entry.
Preserve version, configuration, patching and exposure information alongside incident records.
Where a named vulnerability is involved, current vendor and authoritative guidance should be checked.
Operational takeaway¶
Use vulnerability evidence to establish what access may have been possible, but require separate evidence that the weakness was exploited in this incident.