Security+Threats and mitigations
Vulnerability types
Group weaknesses by what failed. The web families on the BSCP track are examples, not extra vocabulary.
16 min read
Objectives
- Sort a weakness into application, configuration, patch, cryptographic, or human
- Map common web bug names onto those buckets
- Choose a category when the stem describes behavior rather than a product
On this page
Core idea
A vulnerability is a weakness an actor could use. The exam groups them by cause:
- Application flaws. The program trusts input, skips a check, or mishandles a boundary. Injection, cross-site scripting, broken access control, and server-side request forgery live here. Read the BSCP notes for the idea. On this exam, name the weakness and the control, not a procedure.
- Misconfiguration. The product can be safe and was left unsafe: default passwords, open storage, directory listing, debug mode, overly broad CORS, missing security headers.
- Missing patches. A vendor fix exists and is not installed. That is a vulnerability-management problem as well as a weakness.
- Cryptographic weaknesses. Weak algorithms, missing salts, certificates that are not validated, secrets committed into a repository.
- Human and process weaknesses. People who can be persuaded, and workflows with no second person on a sensitive change. Those are still vulnerabilities. The vector is often social.
- Design weaknesses. No segmentation, shared admin accounts, or a trust decision that lives only in the browser. Patching does not fix a design.
Zero-day means no vendor patch is available yet. It is not a synonym for “bad” or for “we did not know.” An unpatched flaw everyone knows about is not a zero-day. It is a missing patch.
Legacy and unsupported software is a standing vulnerability: the fix stream ended. The mitigation is isolation or replacement, which is often a compensating control.
Exam lens
Translate the story. “The site put the user’s words into the page as markup” is an application flaw in the XSS family. “The bucket was world-readable” is misconfiguration. “The server runs a version the vendor patched last quarter” is missing a patch. “Anyone on the LAN can reach the database” is design, specifically missing segmentation. Pick the answer that names the cause they described.
Common pitfalls
Calling every incident a zero-day. Treating configuration and code as the same fix. Listing CVE numbers you memorized. The exam wants the class. Forgetting that a strong algorithm with a broken trust decision (not checking the certificate name) is still a cryptographic weakness.
Related BSCP notes
- SQL injectionSQL injection is what happens when untrusted input changes the structure of a query instead of staying a value.
- Cross-site scriptingXSS is attacker-controlled content executing in a victim's browser because a page mixed data into a markup or script context.
- Access control and IDORAccess control fails when the server uses an identifier the client sent and does not check it against the caller.