Vulnerability (computer security)

In the field of computer security, a vulnerability is a flaw or weakness. These flaws appear in a system's design, implementation, or management. A malicious actor can exploit these weaknesses to compromise security. This compromise usually affects confidentiality, integrity, or availability. Confidentiality ensures only authorized people see data. Integrity ensures data remains accurate and unchanged. Availability ensures systems work when they are needed. Virtually all hardware and software contain bugs. A bug becomes a vulnerability only when it creates a specific security risk.

Understanding how a vulnerability functions requires looking at its lifecycle. A vulnerability is initiated when it is first introduced into hardware or software. At this stage, it is often called a carrier. It becomes an active vulnerability when the software or hardware is actually running. An attacker needs an active vulnerability to perform an exploit. An exploit is the method used to take advantage of the flaw. Once a vulnerability is discovered, it might be publicly disclosed. This disclosure can increase risk because attackers can then target systems before patches arrive. Vulnerabilities eventually end when the system is patched or removed from use.

There are several distinct types of vulnerabilities categorized by their impact. Some allow for denial-of-service attacks, which stop a system from working. Others allow for code injection, where an attacker runs their own programs. A more severe type is privilege escalation. This allows an attacker to gain higher levels of access than they should have. Vulnerabilities also exist in different components. Hardware vulnerabilities can be introduced during manufacturing. Operating system vulnerabilities often involve privilege escalation. Client-server applications can suffer from process hijacking. Web applications are a major source of security incidents. They may face cross-site scripting (XSS) or SQL injection attacks.

Many factors contribute to the creation of these digital weaknesses. Complexity is a major design factor. Large, complex systems increase the chance of unintended access points. Connectivity also plays a role. Any system connected to the internet can be accessed by attackers. Legacy systems, which are older hardware or software, are at higher risk. Development practices also matter significantly. A lack of training or excessive pressure to deliver can lead to bugs. Inadequate code reviews can also allow vulnerabilities to go unnoticed. Even modern workflows like DevOps can introduce risks if many developers have access to change configurations.

Organizations use vulnerability management to handle these risks. This process involves identifying important systems and scanning them for flaws. Management typically uses a combination of three strategies. The first is remediation, which means fixing the flaw, often with a software patch. The second is mitigation, which makes the flaw harder to exploit. This might involve reducing the attack surface. The third is acceptance, where a company chooses to live with a residual risk. Many organizations use a defense in depth strategy. This means they use multiple layers of security to protect a system.

To organize this information, experts use standardized systems. The Common Vulnerability Scoring System, or CVSS, scores vulnerabilities by severity. The Common Vulnerabilities and Exposures (CVE) database catalogs known flaws. As of November 2024, the CVE database contained more than 240,000 vulnerabilities. The National Vulnerability Database also classifies vulnerabilities into eight root causes. These include input validation errors and access control failures. Configuration vulnerabilities occur when settings create security risks. Race conditions happen when timing changes the outcome of a process in an unpredictable way.

Managing these risks is a constant challenge for administrators. Achieving perfect security is considered impossible for complex systems. Many security measures can also be expensive or difficult to use. For example, reducing a system's complexity can help, but it might make the system less useful. Organizations must prioritize their efforts because they lack the resources to fix everything. They often focus on the highest-risk vulnerabilities first. This helps them manage the cost and the time needed for repairs.