Skip to content

Introduction to Security Threat, Attack, Vulnerability, Exploit

2.1

Identity Theft

Identity theft, i.e. using somebody else’s ‘identity’ (name, social security number, bank account number, etc.) to gain access to a resource or service, exploits a weakness inherent in services that use non-secret information to authenticate requests.

2.3

Risk and Asset

Risk is the possibility that some incident or attack can cause damage to your enterprise.

Pasted image 20260223182120.png

Systems consist of resources and of agents operating on those resources. In a computer, processes are the agents. In an organization, an agent can be a person given a task to perform. This person may have been authorized to use resources necessary for executing the task. Corruption of a resource can be categorized according to confidentiality, integrity, and availability (Chapter 3)

Asset

Asset are entities that organisation/individual is looking to protect.

As a first step assets have to be identified and valued. In an IT system, assets include: • hardware – laptops, servers, routers, mobile phones, netbooks, smart cards, etc.; • software – applications, operating systems, database management systems, source code, object code, etc.;

Threat

A threat is an undesirable negative impact on your assets.

  • Spoofing
  • Tampering
  • Repudiate
  • Information Disclosure
  • DOS
  • Elevation of Privilege

Vulnerabilities

Vulnerabilities are specific weaknesses in a system that can be exploited to cause damage to assets

Attacks

An attack is a sequence of steps an adversary (an entity trying to defeat a security service) takes to reach a goal

Attacks are broadly classified by the sources into two types:

  • Passive Attacks: The adversary only monitors the communication channel

These threaten confidentiality. Common types include ciphertext-only attacks where an adversary tries to deduce a key just by observing traffic- . - Active Attacks: The adversary attempts to delete, add, or alter transmissions These threaten data integrity and authentication. Examples include impersonation and replay attacks