Build the idea first, then use the next activity to check it.
Threats, vulnerabilities and the words in between
Four terms that are used interchangeably and should not be, and the two principles that decide most network security design.
What you will be able to do
- Distinguish a threat, a vulnerability, an exploit and a risk
- Explain the three properties security is trying to protect
- Apply least privilege to a filtering decision
- Say what defence in depth buys that a single strong control does not
Before this: You should know what an access control list does - see "Filtering traffic with an ACL". Nothing else.
Why it matters: These four words appear throughout both exams and in every security conversation you will have, and they are routinely swapped for one another. Using them precisely is not pedantry - a vulnerability with no threat and a threat with no vulnerability need completely different responses.
Security writing is full of sentences like "we found a threat on the file server". That could mean four different things, each needing a different response, which is why the vocabulary is worth getting right before anything else.
| Term | What it is | Example |
|---|---|---|
| Vulnerability | A weakness that could be taken advantage of | A management interface reachable from the whole office network |
| Threat | Something or someone that might take advantage of it | Anyone who can plug into an office port |
| Exploit | The specific method of taking advantage of it | Logging in to that interface with a default password |
| Risk | The chance of it happening, combined with what it would cost | High, because the interface controls every route in the building |
The reason these are separated is that each one can be addressed independently. You can remove a vulnerability by restricting the interface. You can reduce a threat by controlling who reaches the network. You cannot do much about an exploit existing. And risk is what you actually decide budgets against.
What is being protected
Security has three goals, and naming which one a control serves is a good check that it is worth having.
| Property | The question it answers | What breaks it |
|---|---|---|
| Confidentiality | Can only the right people read this? | An open share, an unencrypted link |
| Integrity | Is this what it was when it was sent? | Modification in transit, a tampered record |
| Availability | Can the right people reach it when they need to? | A failed link, a denial-of-service flood, an over-broad filter |
Least privilege
Every account, device and traffic flow gets exactly the access it needs to do its job, and nothing beyond that. Applied to a network, it means a filter starts by permitting the specific flows that are required and denying everything else - not by blocking the things somebody thought of and allowing the rest.
Two rules with the same intent and different consequences
The contractor auditing the accounts system needs to reach one server. One approach denies them the finance subnet and permits everything else; the other permits that one server and denies everything else. Both satisfy the immediate request. The first also grants access to every system nobody thought about during the conversation, including the ones built next year.
That is why the default-deny ordering matters so much in an access control list. A list that ends in an implicit deny expresses least privilege by construction; a list of specific denials expresses a guess about what is dangerous.
Defence in depth
No single control is reliable. Rules get edited, devices get replaced, someone approves an exception at five o'clock on a Friday. Defence in depth assumes each layer will occasionally fail and arranges that no single failure is sufficient.
- Segmentation, so a compromised machine reaches less of the network.
- Filtering at the boundary between segments, so movement between them is explicit.
- Authentication on devices, so reaching a management interface is not the same as controlling it.
- Monitoring, so a failure of the above is noticed rather than discovered later.
Mitigation, and the other options
Mitigation means reducing a risk rather than removing it, and it is one of four responses. Naming which one you have chosen is useful, because three of them are legitimate and the fourth is what happens when nobody decides.
| Response | What it means |
|---|---|
| Mitigate | Reduce the likelihood or the impact - the usual technical work |
| Transfer | Make it someone else's cost, typically by insurance or contract |
| Avoid | Stop doing the thing that creates the risk |
| Accept | Decide it is tolerable, deliberately and on the record |
Accepting a risk is a real and often correct decision. The failure mode is accepting one without noticing, which is indistinguishable from accepting it deliberately right up until the moment it matters.
Terminology
- Vulnerability
- A weakness that could be taken advantage of.
- Threat
- Something or someone that might take advantage of a vulnerability.
- Exploit
- The specific technique used to take advantage of one.
- Risk
- Likelihood combined with impact - what you actually prioritise on.
- Least privilege
- Granting exactly the access required and nothing more, so that unlisted access is denied rather than permitted.
- Defence in depth
- Layering controls so that no single failure is enough on its own.
Key takeaways
- A vulnerability is the weakness, a threat is who might use it, an exploit is how, risk is what it costs.
- Security protects confidentiality, integrity and availability - and availability is the one controls most often break.
- Least privilege means permitting what is needed and denying the rest, not denying what seems dangerous.
- A default-deny list expresses least privilege by construction; a list of denials expresses a guess.
- Defence in depth assumes every layer will sometimes fail, so no single failure is enough.
- Mitigate, transfer, avoid or accept - and accepting by accident is the failure mode.
Ready to keep going?
Create a free account to save your progress and take the knowledge check.