Key Security Concepts Tutorial

In today’s digital world, protecting information is one of the most important responsibilities an administrator has. Before diving into specific security technologies, it helps to have a clear grasp of a few core concepts that come up again and again in security discussions: vulnerability, exploit, threat, and mitigation.

A House Analogy

Think of a house built from strong materials, such as brick. On its own, a solid brick wall is very secure — nothing can easily get through it. But a house also needs doors and windows to actually be usable: people need to get in and out, and light needs to come through. Those openings are necessary, but they are also exactly where the house becomes less secure than a solid wall. In security terms, each door and window is a weak point that someone could potentially use to get in. This same idea — that usability and openness almost always come at the cost of some security — applies directly to computer networks.

Vulnerability

A vulnerability is a weakness or flaw in the way a system is designed, implemented, or operated. It is the “door or window” of the house analogy: a point where the system is not as solid as the rest of it, and which an attacker could potentially take advantage of to compromise the system’s security.

Exploit

An exploit is the actual tool, program, or sequence of commands that an attacker uses to take advantage of a specific vulnerability. Where a vulnerability is simply the open door, the exploit is what someone actually uses to walk through it — the mechanism that turns a weakness into unauthorized access or some other harmful action against the system.

Threat

A threat is any potential danger to a system — something that, if it occurred, could violate the system’s security. Importantly, a threat exists whether or not any protective measures are in place; it simply describes a possible source of harm, independent of how well-defended the system currently is.

Mitigation

Mitigation refers to the measures put in place to reduce the risk posed by a threat. Going back to the house analogy, this is the equivalent of fitting stronger locks, reinforcing a door with steel, or adding bars to a window: none of these measures remove the opening entirely, but they make it considerably harder for an attacker to exploit it.

Summary

• Vulnerability — a weakness in a system that could be exploited.
• Exploit — the tool or technique used to take advantage of a vulnerability.
• Threat — a potential danger that could cause harm to a system, regardless of current defenses.
• Mitigation — measures taken to reduce the risk associated with a threat.