Concepts for Cybersecurity
Define and differentiate Vulnerability, Risk, and Threat
Define the term “Zero-Day Exploit”. Discuss some recent examples where one or two ZDEs were used to bypass cybersecurity controls to open a hole in vulnerable Critical Infrastructures, SCADA systems, or Industrial Control Systems (ICS) so malicious code could enter to cause disruptive effects. Describe how ZDEs can possibly be used by nation states, criminals, and political extremists.
Sample Solution
Concepts for Cybersecurity
Cyber security is the protection of internet-connected systems such as hardware, software and data from cyber threats. Threat, vulnerability, and risk are the most commonly mixed up security terms. A threat is what we are trying to protect against. Vulnerability is the weaknesses or gaps in a security program that can be exploited by threats to gain unauthorized access to an asset. Risk is the potential for loss, damage or destruction of an asset as a result of a threat exploiting a vulnerability. A Zero-day exploit is an unknown exploit in the wild that exposes a vulnerability in software or hardware and can create complicated problems well before anyone realizes something is wrong. For example, Stuxnet, a type of Zero-day vulnerability, was one of the earliest digital weapons used. It is a highly infectious self-replicating computer worm that disrupted Iranian nuclear plants.
