Vulnerability (computer security): Difference between revisions

Revision as of 09:48, 17 October 2024

Latest revision as of 03:46, 13 August 2025

(36 intermediate revisions by 26 users not shown)

Line 1:

{{short description|Exploitable weakness in a computer system}}

{{Computer hacking}}

'''Vulnerabilities''' are flaws or weaknesses in a computer system's design, implementation, or management that weakencan thebe overallexploited securityby ofa themalicious system.actor to compromise its security.

Despite intentionsa [[system administrator]]'s best efforts to achieve complete correctness, virtually all hardware and software containscontain [[Software bug|bugs]] where the system does not behave as expected. If the bug could enable an attacker to compromise the [[confidentiality]], [[Data integrity|integrity]], or [[availability]] of system resources, it iscan be calledconsidered a vulnerability. Insecure [[software development]] practices as well as design factors such as complexity can increase the burden of vulnerabilities. There are different types most common in different components such as hardware, operating systems, and applications.

[[Vulnerability management]] is a process that includes identifying systems and prioritizing which are most important, scanning for vulnerabilities, and taking action to secure the system. Vulnerability management typically is a combination of remediation (fixing the vulnerability), mitigation (increasing the difficulty or reducing the danger of exploits), and accepting risks that are not economical or practical to eliminate. Vulnerabilities can be scored for risk according to the [[Common Vulnerability Scoring System]] or other systems, and added to vulnerability databases. {{as of|2023}}, there are more than 20 million vulnerabilities catalogued in the [[Common Vulnerabilities and Exposures]] (CVE) databaseacceptance.

Vulnerabilities can be scored for severity according to the [[Common Vulnerability Scoring System]] (CVSS) and added to vulnerability databases such as the [[Common Vulnerabilities and Exposures]] (CVE) database. As of November 2024, there are more than 240,000 vulnerabilities catalogued in the CVE database.<ref name="Metrics">{{cite web |url=https://www.cve.org/About/Metrics |title=CVE - Program Metrics |date=15 November 2024 }}</ref>

A vulnerability is initiated when it is introduced into hardware or software. It becomes active and exploitable when the software or hardware containing the vulnerability is running. The vulnerability may be discovered by the vendor or a third party. Disclosing the vulnerability (as a [[software patch |patch]] or otherwise) is associated with an increased risk of compromise because attackers often move faster than patches are rolled out. Regardless of whether a patch is ever released to remediate the vulnerability, its lifecycle will eventually end when the system, or older versions of it, fall out of use.

A vulnerability is initiated when it is introduced into hardware or software. It becomes active and exploitable when the software or hardware containing the vulnerability is running. The vulnerability may be discovered by the administrator, vendor, or a third party. DisclosingPublicly [[Full disclosure (computer security)|disclosing the vulnerability]] (asthrough a [[software patchPatch (computing)|patch]] or otherwise) is associated with an increased risk of compromise, becauseas attackers oftencan moveuse fasterthis thanknowledge patchesto aretarget rolledexisting out.systems Regardlessbefore ofpatches whetherare a patch is ever released to remediate the vulnerability, itsimplemented. lifecycleVulnerabilities will eventually end when the system, oris oldereither versionspatched ofor it,removed fall out offrom use.

==Causes ==

Despite developers' goal of delivering a productsystem thatadministrator's worksbest entirely as intendedefforts, virtually all [[software bugs|software]]hardware and [[hardware bug|hardware]]software containscontain bugs.{{sfn|Ablon|Bogart|2017|p=1}} If a bug creates a security risk, it is called a vulnerability.{{sfn|Ablon|Bogart|2017|p=2}}{{sfn|Daswani |Elbayadi|2021|p=25}}{{sfn|Seaman|2020|pp=47-48}} [[Software patch]]espatches are often released to fix identified vulnerabilities, but those that remain unknown ([[Zerozero-day (computing)|zero daydays]]s) as well as those that have not been patched are still liable for exploitation.{{sfn|Daswani |Elbayadi|2021|pp=26-27}} Vulnerabilities vary in their ability to be [[Exploit (computer security)|exploitexploited]]ed by malicious actors,{{sfn|Ablon|Bogart|2017|p=2}} and the actual risk is dependent on the nature of the vulnerability as well as the value of the surrounding system.{{sfn|Haber |Hibbert|2018|pp=5-6}} Although some vulnerabilities can only be used for [[denial of service]] attacks, more dangerous ones allow the attacker to perform [[code injection|inject]] and run their own code (called [[malware]]), without the user's being aware of itawareness.{{sfn|Ablon|Bogart|2017|p=2}} Only a minority of vulnerabilities allow for [[privilege escalation]], which is typically necessary for more severe attacks.{{sfn|Haber |Hibbert|2018|p=6}} Without a vulnerability, thean exploit typically cannot gain access.{{sfn|Haber |Hibbert|2018|p=10}} It is also possible for [[malware]] to be installed directly, without an exploit, if the attacker usesthrough [[Social engineering (security)|social engineering]] or implantspoor the[[physical malwaresecurity]] insuch legitimateas softwarean thatunlocked isdoor or downloadedexposed deliberatelyport.{{sfn|Haber |Hibbert|2018|pp=13–14}}

==Causes ==

Despite developers' goal of delivering a product that works entirely as intended, virtually all [[software bugs|software]] and [[hardware bug|hardware]] contains bugs.{{sfn|Ablon|Bogart|2017|p=1}} If a bug creates a security risk, it is called a vulnerability.{{sfn|Ablon|Bogart|2017|p=2}}{{sfn|Daswani |Elbayadi|2021|p=25}}{{sfn|Seaman|2020|pp=47-48}} [[Software patch]]es are often released to fix identified vulnerabilities, but those that remain unknown ([[Zero-day (computing)|zero day]]s) as well as those that have not been patched are still liable for exploitation.{{sfn|Daswani |Elbayadi|2021|pp=26-27}} Vulnerabilities vary in their ability to be [[Exploit (computer security)|exploit]]ed by malicious actors,{{sfn|Ablon|Bogart|2017|p=2}} and the actual risk is dependent on the nature of the vulnerability as well as the value of the surrounding system.{{sfn|Haber |Hibbert|2018|pp=5-6}} Although some vulnerabilities can only be used for [[denial of service]] attacks, more dangerous ones allow the attacker to [[code injection|inject]] and run their own code (called [[malware]]), without the user being aware of it.{{sfn|Ablon|Bogart|2017|p=2}} Only a minority of vulnerabilities allow for [[privilege escalation]], which is necessary for more severe attacks.{{sfn|Haber |Hibbert|2018|p=6}} Without a vulnerability, the exploit cannot gain access.{{sfn|Haber |Hibbert|2018|p=10}} It is also possible for [[malware]] to be installed directly, without an exploit, if the attacker uses [[Social engineering (security)|social engineering]] or implants the malware in legitimate software that is downloaded deliberately.{{sfn|Haber |Hibbert|2018|pp=13–14}}

===Design factors===

Vulnerabilities can be worsened by poor design factors, such as:

Fundamental design factors that can increase the burden of vulnerabilities include:

*Complexity: Large, complex systems increase the probabilitypossibility of flaws and unintended [[File system permissions|access point]]spoints.<ref name=Vacca23>{{cite book|last= Kakareka|first=Almantas|editor-last=Vacca|editor-first=John|title=Computer and Information Security Handbook|series=Morgan Kaufmann Publications|year=2009|publisher= Elsevier Inc|isbn= 978-0-12-374354-1|page=393|chapter=23}}</ref>

*Familiarity: Using common, well-known code, software, operating systems, and/or hardware increases the probability an attacker has or can find the knowledge and tools to exploit the flaw.<ref>{{cite book | title = Technical Report CSD-TR-97-026 | first = Ivan | last = Krsul | publisher = The COAST Laboratory Department of Computer Sciences, Purdue University | date = April 15, 1997 | citeseerx = 10.1.1.26.5435 }}</ref> However, using well-known software, particularly [[free and open-source software]], comes with the benefit of having more frequent and reliable software patches for any discovered vulnerabilities.{{cn|date=May 2025}}

|last= Kakareka

*Connectivity: any system connected to the internet can be accessed and compromised. [[Air gap (networking)|Disconnecting systems from the internet]] iscan onebe trulyextremely effective measureat againstpreventing attacks, but it is rarelynot always feasible.{{sfn|Linkov|Kott|2019|p=2}}

|first=Almantas

*[[Legacy software]] and [[legacy hardware|hardware]] is at increased risk, butby nature.{{sfn|Haber |Hibbert|2018|p=155}} System administrators should consider upgrading oftenfrom legacy systems, but this is often prohibitive in terms of cost and [[downtime]].{{sfncn|Haber |Hibbert|2018|pdate=155May 2025}}

|editor-last=Vacca

|editor-first=John

|title=Computer and Information Security Handbook

|series=Morgan Kaufmann Publications

|year=2009

|publisher= Elsevier Inc

|isbn= 978-0-12-374354-1

|page=393

|chapter=23

}}

</ref>

*Familiarity: Using common, well-known code, software, operating systems, and/or hardware increases the probability an attacker has or can find the knowledge and tools to exploit the flaw.<ref>{{cite book | title = Technical Report CSD-TR-97-026 | first = Ivan | last = Krsul | publisher = The COAST Laboratory Department of Computer Sciences, Purdue University | date = April 15, 1997 | citeseerx = 10.1.1.26.5435 }}</ref>

*Connectivity: any system connected to the internet can be accessed and compromised. [[Air gap (networking)|Disconnecting systems from the internet]] is one truly effective measure against attacks, but it is rarely feasible.{{sfn|Linkov|Kott|2019|p=2}}

*[[Legacy software]] and [[legacy hardware|hardware]] is at increased risk, but upgrading often is prohibitive in terms of cost and [[downtime]].{{sfn|Haber |Hibbert|2018|p=155}}

===Development factors===

Some [[software development]] practices can affect the risk of vulnerabilities being introduced to a code base. Lack of knowledge about secure software development or excessive pressure to deliver features quickly can lead to avoidable vulnerabilities to enter production code, especially if security is not prioritized by the [[company culture]]. This can lead to unintended vulnerabilities. The more complex the system is, the easier it is for vulnerabilities to go undetected. Some vulnerabilities are deliberately planted, which could be for any reason from a disgruntled employee selling access to hackerscyber criminals, to sophisticated state-sponsored schemes to introduce vulnerabilities to software.{{sfn|Strout|2023|p=17}} Inadequate [[code review]]s can lead to missed bugs, but there are also [[Static application security testing|static code analysis]] tools that can be used as part of code reviews and may find some vulnerabilities.{{sfn|Haber |Hibbert|2018|p=143}}

Poor [[software development]] practices can affect the likelihood of introducing vulnerabilities to a code base. Lack of knowledge or training regarding secure software development, excessive pressure to deliver, or an excessively complex code base can all allow vulnerabilities to be introduced and left unnoticed. These factors can also be exacerbated if security is not prioritized by the [[company culture]].{{sfn|Strout|2023|p=17}} Inadequate [[code review]]s can also lead to missed bugs, but there are also [[Static application security testing|static code analysis]] tools that can be used during the code review process to help find some vulnerabilities.{{sfn|Haber |Hibbert|2018|p=143}}

[[DevOps]], a development workflow that emphasizes automated testing and deployment to speed up the deployment of new features, often requires that many developers be granted access to change configurations, which can lead to deliberate or inadvertent inclusion of vulnerabilities.{{sfn|Haber |Hibbert|2018|p=141}} Compartmentalizing dependencies, which is often part of DevOps workflows, can reduce the [[attack surface]] by paring down dependencies to only what is necessary.{{sfn|Haber |Hibbert|2018|p=142}} If [[software as a service]] is used, rather than the organization's own hardware and software, the organization is dependent on the cloud services provider to prevent vulnerabilities.{{sfn|Haber |Hibbert|2018|pp=135-137}}

===National Vulnerability Database classification===

{{missing information|section|the other causes|date=May 2025}}

The [[National Vulnerability Database]] classifies vulnerabilities into eight root causes that may be overlapping, including:{{sfn|Garg|Baliyan|2023|pp=17–18}}

#[[Improper input validation|Input validation]] (including [[buffer overflow]] and [[boundary condition]]) vulnerabilities occurexist when [[input checking]] is not sufficient to prevent the attacker from injecting malicious code. [[Buffer overflow]] exploits, [[buffer underflow]] exploits, and [[boundary condition]] exploits typically take advantage of this category.{{sfn|Garg|Baliyan|2023|p=17}}

# [[Access control]] vulnerabilities enable an attacker to access a system that is supposed to be restricted to them, or engage in [[privilege escalation]].{{sfn|Garg|Baliyan|2023|p=17}}

#When the system fails to handle and exceptional or unanticipated condition correctly, an attacker can exploit the situation to gain access.{{sfn|Garg|Baliyan|2023|p=18}}

#A [[configuration Configuration vulnerability]] comescome into existence when configuration settings cause risks to the system security, leading to such faults as unpatched software or file system permissions that do not sufficiently restrict access.{{sfn|Garg|Baliyan|2023|p=18}}

#A [[race condition]]—when timing or other external factors change the outcome and lead to inconsistent or unpredictable results—can cause a vulnerability.{{sfn|Garg|Baliyan|2023|p=18}}

==Vulnerabilities by component==

===Hardware ===

{{main |Hardware security bug}}

Deliberate security bugs can be introduced during or after manufacturing and cause the [[integrated circuit]] not to behave as expected under certain specific circumstances. Testing for security bugs in hardware is quite difficult due to limited time and the complexity of twenty-first century chips,{{sfn|Salmani|2018|p=1}} while the globalization of design and manufacturing has increased the opportunity for these bugs to be introduced by malicious actors.{{sfn|Salmani|2018|p=11}}

===Operating system ===

{{see also|Operating system#Security}}

Although [[operating system vulnerabilities]] vary depending on the [[operating system]] in use, a common problem is [[privilege escalation]] bugs that enable the attacker to gain more access than they should be allowed. [[Open-source]] operating systems such as [[Linux]] and [[Android (operating system)|Android]] have a freely accessible [[source code]] and allow anyone to contribute, which could enable the introduction of vulnerabilities. However, the same vulnerabilities also occur in proprietary operating systems such as [[Microsoft Windows]] and [[List of Apple operating systems|Apple operating systems]].{{sfn|Garg|Baliyan|2023|pp=20-25}} All reputable vendors of operating systems provide patches regularly.{{sfn |Sharp|2024|p=271}}

Line 53 ⟶ 50:

*Unencrypted data that is in permanent storage or sent over a network is relatively easy for attackers to steal.{{sfn |Strout |2023|p=15}}

*[[Process hijacking]] occurs when an attacker takes over an existing [[computer process]].{{sfn |Strout |2023|p=15}}

===Web applications===

[[Web applications]] run on many websites. Because they are inherently less secure than other applications, they are a leading source of [[data breach]]es and other security incidents.{{sfn |Strout |2023|p=13}}{{sfn|Haber |Hibbert|2018|p=129}} They can include:

*[[Authentication]] and [[authorization]] failures enable attackers to access data that should be restricted to trusted users.{{sfn |Strout |2023|p=13}}

*[[Business logic vulnerability]] occurs when programmers do not consider unexpected cases arising in [[business logic]].

*

*Attacks used against vulnerabilities in web applications include:

*

*[[Cross-site scripting]] (XSS) enables attackers to [[code injection|inject]] and run [[JavaScript]]-based [[malware]] when [[input checking]] is insufficient to reject the injected code.{{sfn |Strout |2023|p=13}} XSS can be persistent, when attackers save the malware in a data field and run it when the data is loaded; it can also be loaded using a malicious [[URL]] link (reflected XSS).{{sfn |Strout |2023|p=13}} Attackers can also insert malicious code into the [[___domain object model]].{{sfn |Strout |2023|p=14}}

*[[SQL injection]] and similar attacks manipulate [[database queries]] to gain unauthorized access to data.{{sfn |Strout |2023|p=14}}

Line 66 ⟶ 63:

*[[Server-side request forgery]] is similar to CSRF, but the request is forged from the server side and often exploits the enhanced privilege of the server.{{sfn |Strout |2023|p=14}}

*[[Business logic vulnerability]] occurs when programmers do not consider unexpected cases arising in [[business logic]].{{sfn |Strout |2023|pp=14-15}}

==Management ==

{{main |Vulnerability management}}

There is little evidence about the effectiveness and cost-effectiveness of different cyberattack prevention measures.{{sfn|Agrafiotis ''et al.''|2018|p=2}} Although estimating the risk of an attack is not straightforward, the mean time to breach and expected cost can be considered to determine the priority for remediating or mitigating an identified vulnerability and whether it is cost effective to do so.{{sfn|Haber |Hibbert|2018 |pp=97-98}} Although attention to security can reduce the risk of attack, achieving perfect security for a complex system is impossible, and many security measures have unacceptable cost or usability downsides.{{sfn |Tjoa ''et al.''|2024|p=63}} For example, reducing the complexity and functionality of the system is effective at reducing the [[attack surface]].{{sfn |Tjoa ''et al.''|2024|pp=68, 70}}

Successful vulnerability management usually involves a combination of remediation (closing a vulnerability), mitigation (increasing the difficulty, and reducing the consequences, of exploits), and accepting some residual risk. Often a [[defense in depth]] strategy is used for multiple barriers to attack.{{sfn |Magnusson |2020|p=34}} Some organizations scan for only the highest-risk vulnerabilities as this enables prioritization in the context of lacking the resources to fix every vulnerability.{{sfn|Haber |Hibbert|2018|pp=166-167}} Increasing expenses is likely to have [[diminishing returns]].{{sfn|Haber |Hibbert|2018 |pp=97-98}}

===Remediation===

Remediation fixes vulnerabilities, for example by downloading a [[software patch]].{{sfn|Haber |Hibbert|2018|p=11}} [[Software vulnerabilityVulnerability scanner]]s are typically unable to detect zero-day vulnerabilities, but are more effective at finding known vulnerabilities based on a database. These systems can find some known vulnerabilities and advise fixes, such as a patch.{{sfn |Strout |2023|p=8}}{{sfn|Haber |Hibbert|2018|pp=12-13}} However, they have limitations including [[false positive]]s.{{sfn|Haber |Hibbert|2018|p=11}}

Vulnerabilities can only be exploited when they are active-the software in which they are embedded is actively running on the system.{{sfn|Haber |Hibbert|2018|p=84}} Before the code containing the vulnerability is configured to run on the system, it is considered a carrier.{{sfn|Haber |Hibbert|2018|p=85}} Dormant vulnerabilities can run, but are not currently running. Software containing dormant and carrier vulnerabilities can sometimes be uninstalled or disabled, removing the risk.{{sfn|Haber |Hibbert|2018|pp=84-85}} Active vulnerabilities, if distinguished from the other types, can be prioritized for patching.{{sfn|Haber |Hibbert|2018|p=84}}

===Mitigation===

Vulnerability mitigation is measures that do not close the vulnerability, but make it more difficult to exploit or reduce the consequences of an attack.{{sfn |Magnusson |2020|p=32}} Reducing the [[attack surface]], particularly for parts of the system with [[Superuser|root]] (administrator) access, and closing off opportunities for exploits to engage in [[privilege exploitation]] is a common strategy for reducing the harm that a cyberattack can cause.{{sfn|Haber |Hibbert|2018|p=11}} If a patch for third-party software is unavailable, it may be possible to temporarily disable the software.{{sfn |Magnusson |2020|p=33}}

===Testing ===

A [[penetration test]] attempts to enter the system via an exploit to see if the system is insecure.{{sfn|Haber |Hibbert|2018|p=93}} If a penetration test fails, it does not necessarily mean that the system is secure.{{sfn|Haber |Hibbert|2018|p=96}} Some penetration tests can be conducted with automated software that tests against existing exploits for known vulnerabilities.{{sfn|Haber |Hibbert|2018|p=94}} Other penetration tests are conducted by trained hackers. Many companies prefer to contract out this work as it simulates an outsider attack.{{sfn|Haber |Hibbert|2018|p=96}}

== Vulnerability lifecycle ==

[[File:Vulnerability timeline.png|thumb|Vulnerability timeline|upright=1.2]]

The vulnerability lifecycle begins when vulnerabilities are introduced into hardware or software.{{sfn|Strout|2023|p=16}} Detection of vulnerabilities can be by the software vendor, or by a third party. In the latter case, it is considered most ethical to immediately disclose the vulnerability to the vendor so it can be fixed.{{sfn|Strout|2023|p=18}} Government or intelligence agencies buy vulnerabilities that have not been publicly disclosed and may use them in an attack, stockpile them, or notify the vendor.{{sfn| Libicki|Ablon|Webb|2015|p=44}} As of 2013, the [[Five Eyes]] (United States, United Kingdom, Canada, Australia, and New Zealand) captured the plurality of the market and other significant purchasers included Russia, India, Brazil, Malaysia, Singapore, North Korea, and Iran.{{sfn |Perlroth |2021 |p=145}} Organized criminal groups also buy vulnerabilities, although they typically prefer [[exploit kit]]s.{{sfn| Libicki|Ablon|Webb|2015|pp=44, 46}}

Line 91 ⟶ 89:

Vulnerabilities become deprecated when the software or vulnerable versions fall out of use.{{sfn|Strout|2023|p=18}} This can take an extended period of time; in particular, industrial software may not be feasible to replace even if the manufacturer stops supporting it.{{sfn|Strout|2023|p=19}}

==Assessment, disclosure, and inventory ==

===Assessment ===

A commonly used scale for assessing the severity of vulnerabilities is the open-source specification [[Common Vulnerability Scoring System]] (CVSS). CVSS evaluates the possibility to exploit the vulnerability and compromise data confidentiality, availability, and integrity. It also considers how the vulnerability could be used and how complex an exploit would need to be. The amount of access needed for exploitation and whether it could take place without user interaction are also factored in to the overall score.{{sfn |Strout |2023|pp=5-6}}{{sfn|Haber |Hibbert|2018|pp=73-74}}

Line 99 ⟶ 97:

===Vulnerability inventory===

The most commonly used vulnerability dataset is [[Common Vulnerabilities and Exposures]] (CVE), maintained by [[Mitre Corporation]].{{sfn |Strout |2023|p=6}} {{As of |2023November 2024}}, it has over 20 million240,000 entries.{{sfn<ref |Strout |2023|pname=8}} "Metrics"/> This information is shared into other databases, including the United States' [[National Vulnerability Database]],{{sfn |Strout |2023|p=6}} where each vulnerability is given a risk score using [[Common Vulnerability Scoring System]] (CVSS), [[Common Platform Enumeration]] (CPE) scheme, and [[Common Weakness Enumeration]].{{cn|date=May 2024}} CVE and other databases typically do not track vulnerabilities in [[software as a service]] products.{{sfn |Strout |2023|p=8}} Submitting a CVE is voluntary for companies that discovered a vulnerability.{{sfn|Haber |Hibbert|2018 |p=110}}

==Liability ==

The software vendor is usually not legally liable for the cost if a vulnerability is used in an attack, which creates an incentive to make cheaper but less secure software.{{sfn|Sloan|Warner|2019|pp=104-105}} Some companies are covered by laws, such as [[Payment Card Industry Security Standards Council|PCI]], [[HIPAA]], and [[Sarbanes-Oxley]], that place legal requirements on vulnerability management.{{sfn|Haber |Hibbert|2018 |p=111}}

==References==

{{reflist|colwidth=30em}}

==Sources ==

{{refbegin|indent=yes}}

*{{cite book |last1=Ablon |first1=Lillian |last2=Bogart |first2=Andy |title=Zero Days, Thousands of Nights: The Life and Times of Zero-Day Vulnerabilities and Their Exploits |date=2017 |publisher=Rand Corporation |isbn=978-0-8330-9761-3 |language=en|url=https://www.rand.org/content/dam/rand/pubs/research_reports/RR1700/RR1751/RAND_RR1751.pdf}}

* {{cite journal | lastlast1=Agrafiotis | firstfirst1=Ioannis | last2=Nurse | first2=Jason R C | last3=Goldsmith | first3=Michael | last4=Creese | first4=Sadie | last5=Upton | first5=David | title=A taxonomy of cyber-harms: Defining the impacts of cyber-attacks and understanding how they propagate | journal=Journal of Cybersecurity | volume=4 | issue=1 | date=2018 | issn=2057-2085 | doi=10.1093/cybsec/tyy006|ref={{sfnref|Agrafiotis et al.|2018}}| doi-access=free }}

*{{cite book |last1=Daswani |first1=Neil|authorlink=Neil Daswani |last2=Elbayadi |first2=Moudy |title=Big Breaches: Cybersecurity Lessons for Everyone |date=2021 |publisher=Apress |isbn=978-1-4842-6654-0}}

*{{cite book |last1=Garg |first1=Shivi |last2=Baliyan |first2=Niyati |title=Mobile OS Vulnerabilities: Quantitative and Qualitative Analysis |date=2023 |publisher=CRC Press |isbn=978-1-000-92451-0 |language=en}}

*{{cite book |last1=Haber |first1=Morey J. |last2=Hibbert |first2=Brad |title=Asset Attack Vectors: Building Effective Vulnerability Management Strategies to Protect Organizations |date=2018 |publisher=Apress |isbn=978-1-4842-3627-7 |language=en}}

*{{cite book |last1=Libicki |first1=Martin C. |last2=Ablon |first2=Lillian |last3=Webb |first3=Tim|url=https://www.rand.org/content/dam/rand/pubs/research_reports/RR1000/RR1024/RAND_RR1024.pdf |title=The Defender’sDefender's Dilemma: Charting a Course Toward Cybersecurity |date=2015 |publisher=Rand Corporation |isbn=978-0-8330-8911-3 |language=en}}

*{{cite book |last1=Linkov |first1=Igor |last2=Kott |first2=Alexander |title=Cyber Resilience of Systems and Networks |date=2019 |publisher=Springer International Publishing |isbn=978-3-319-77492-3 |pages=1–25 |language=en |chapter=Fundamental Concepts of Cyber Resilience: Introduction and Overview}}

*{{cite book |last1=Magnusson |first1=Andrew |title=Practical Vulnerability Management: A Strategic Approach to Managing Cyber Risk |date=2020 |publisher=No Starch Press |isbn=978-1-59327-989-9 |language=en}}

Line 131 ⟶ 130:

{{Information security}}

{{Authority control}}