Global Security, Privacy, & Risk Management

Security, Exploits & Vulnerabilities- Security is Never 100% February 16, 2012

In light of the recent disclosures of breaches of major security technologies and vendors, I felt compelled to write this post.  One of my favorite subjects to debate (and argue over) is security theory in general, and specifically the topics of vulnerabilities & exploits.  They are concepts that are critical in the fields of information security, risk management and other areas of security.  In truth, the concepts extend beyond IS but they are very common in the IS World and easier, in my opinion, to discuss in the context of IS.  So what are exploits & vulnerabilities and why are they important?

First, we need to understand that there is no “guaranteed security” and security can never be 100% as there are always vulnerabilities which can be exploited. We may not have identified them yet, but they do exist.   Given enough time, effort, and the right tools, any security control can be circumvented.  Security should be viewed as a function of time and effort. (this will be discussed below)  Second it is important to understand that the concepts of exploits and vulnerabilities are inextricably entwined and are mutually dependent. This is where the debate begins so first lets get a working definition of the terms. (more…)