Concepts for Cybersecurity
Define and differentiate Vulnerability, Risk, and Threat
Define the term “Zero-Day Exploit”. Discuss some recent examples where one or two ZDEs were used to bypass cybersecurity controls to open a hole in vulnerable Critical Infrastructures, SCADA systems, or Industrial Control Systems (ICS) so malicious code could enter to cause disruptive effects. Describe how ZDEs can possibly be used by nation states, criminals, and political extremists.
Sample Solution
Concepts for Cybersecurity
Cybersecurity is the practice of defending computers, servers, mobile devices, electronic systems, networks, and data from malicious attacks. Vulnerability is weaknesses or gaps in a security program that can be exploited by threats to gain unauthorized access to an asset. A threat is what we are trying to protect against. Risk is the potential for loss, damage or destruction of an asset as a result of a threat exploiting a vulnerability. A Zero-Day Exploit is an unknown exploit in the wild that exposes a vulnerability in software or hardware and can create complicated problems before anyone realizes something is wrong. For example, the attack on Microsoft windows in June 2019 that targeted Eastern Europe was identified by a group of researchers from Essential Security against Evolving Threats [ESET]. Hackers can use zero-day exploits to attack systems. These threats are dangerous because only the attacker is aware of their existence.
