The importance of vulnerability classification
Security researchers have long understood the importance of classifying vulnerabilities within software and hardware systems. Classification allows researchers to group similar vulnerabilities together based on their characteristics and then apply standard patterns for mitigation and protection.
Flaws versus vulnerabilities versus exploits versus threats versus risks
The preceding terms cause confusion in the security industry, so it is worth disambiguating them as they are subtly different.
A flaw is an implementation defect or weakness in code that may be latent or exploitable.A vulnerability is a flaw that can be exploited by an attacker. An exploit is a procedure or method used by an attacker to take advantage of a flaw, that is, it is the “how” of a vulnerability. A threat is anything that has the potential to do harm to a system, and it can be intentional (a hacker) or unintentional (forgetting to patch a system...
