Team

Is weakness in a system, either by design, configuration, or process, that renders it open to exploitation by a given threat or susceptible to a given hazard. A system is said to be vulnerable when it provides the opportunity for a threat to break a security attribute it is meant to maintain. Vulnerabilities are caused by mistakes and our fallible ability to design secure systems. System is also used in the broadest sense of the word, a user is part of the system and therefore introduces vulnerabilities. Policies, data artifacts, and humans can all have vulnerabilities that adversaries can take advantage of, do not fixate on just software, network, or hardware vulnerabilities.

Integrity relates to only allowing authorized users to modify data in cyber space. When data is exchanged between actors in cyber space, it often passes through shared areas where other actors have the ability to modify data before it reaches its recipient. Therefore, a critical concept of cyber security is that some data is critical and must remain unchanged between sender and receiver.

Actors within cyber space are projections of physical objects, either people or systems. To enable decisions on who and what is allowed access to resources, it is critical to have the ability to authenticate actors within cyber space to their physical reality with some level of assurance. Connectability applies to actions and data within cyber space; that is, you authenticate actions and data as having come from a user.

An instance of a method designed to take advantage of a vulnerability in a system to breach its security is an exploit. An exploit is the realization of a vulnerability. While there can be many vulnerabilities in a system, there isn’t an exploit until a threat actor develops a tool or method to take advantage of the vulnerability to subvert a system’s security.