Security vulnerability is a weakness in a product or system that could allow an attacker to compromise the integrity, availability, or confidentiality of that product or a system.

• Different types of Vulnerabilities:

1. Software vulnerabilities-

Software vulnerabilities are when applications have errors or bugs in them. Attackers look at buggy software as an opportunity to attack the system making use of these flaws.

Example: Buffer overflow, race conditions etc.

2. Firewall Vulnerabilities-

Firewalls are software and hardware systems that protect intra-network from attacks. A firewall vulnerability is an error, weakness or invalid assumption made during the firewall design, implementation or configuration that can be exploited to attack the trusted network that the firewall is supposed to protect.

3. TCP/IP Vulnerabilities-

These vulnerabilities are of the various layers of a network. These protocols may lack features that are desirable on the insecure network.

Example: ARP attacks, Fragmentation attacks etc

4. Wireless Network Vulnerabilities-

Wireless LANs have similar protocol-based attacks that plague wired LAN. Unsecured wireless access points can be a danger to organizations as they offer the attacker a route around the company’s network. Example: SSID issues, WEP issues etc.

5. Operating System Vulnerabilities-

The security of applications running on depends on the security of the operating system. Slightest negligence by the system administrator can make the operating systems vulnerable.

Example: Windows vulnerabilities, Linux vulnerabilities.

6. Web Server Vulnerabilities-

These vulnerabilities are caused due to design and engineering errors or faulty implementation. Example: sniffing, spoofing etc.

Threat is an exploitation of a system where the attacker can cause harm or loss to the system.

• Different types of Threats:

1. Interception-

When an attacker gains unauthorized access to confidential information, it is known as interception. Example: Snooping , Traffic analysis

2. Interruption-

When important information of the system is lost or unavailable to a user due to some reason it is known as interruption. Example: Denial of Service (DoS)

3. Modification-

If an attacker gets access to a user’s information and can also tamper it then such a threat is known as a modification.

4. Fabrication-

An attacker can create or fabricate counterfeit objects on a computing system. The attacker may insert extra transaction to a network communication system or add records to existing database. Example: Man-in-the-middle attack, Replaying attack etc

• Different types of Control:

1.Encipherment-

The use of mathematical algorithms to transform data into a form that is not readily intelligible form is known as encryption. Encryption preserves confidentiality of data but it can also preserve the integrity of data. Example: Symmetric-key and asymmetric key encipherment.

2.Authentication-

This is a mechanism intended to ensure the identity of a user by means of information exchange. Example: Passwords, Biometrics etc.

3.Authorization-

Authorization is a process of granting or denying access to a network resource. Example: Capabilities, Access control matrix, CAPTHCA etc.

4.Firewalls-

Firewall is a security barrier between two networks that screens traffic coming in and out of the gate of one network to accept or reject connections and services according to a set of rules. Example: packet filter firewall, state filter firewall, proxy firewall and personal firewall.

5.Digital Signatures-

A digital signature is a means by which the sender can electronically sign the data and the receiver can electronically verify the signature.