Threats, Vulnerabilities, and Mitigations · Topic 5 of 9
Hardware, Cloud, Mobile and Supply Chain Risks
Security+ vulnerability types in hardware, virtualization, cloud, supply chain and mobile devices, including VM escape, side loading and end of life.
- 4 min
- Firmware flaws are low level and hard to detect. Keep firmware updated.
- End of life and legacy hardware lack security fixes and need isolation or replacement.
- VM escape breaks out of a virtual machine. VM sprawl is unmanaged growth of VMs.
What it is
Not every weakness lives in an application. Hardware, virtualized systems, cloud services, mobile devices and the supply chain each add their own kinds of risk.
These areas share one feature: the organization does not fully control them. Someone else may build the hardware, run the cloud platform or write the software, so risk has to be managed through selection, configuration and monitoring.
How it works
Hardware vulnerabilities
| Issue | Meaning |
|---|---|
| Firmware | Low level software on a device that may contain flaws or be tampered with |
| End of life | The vendor has announced that it will stop sale and soon support |
| Legacy | Old equipment still in use, often without security updates |
End of life means the vendor stops selling the product and prepares to stop support. End of support is the point when security fixes stop. Both create hardware that attackers can target without fear of a patch.
Virtualization vulnerabilities
Virtual machines (VMs) share the physical hardware of a host, which creates specific risks.
| Issue | Meaning |
|---|---|
| VM escape | An attacker breaks out of a VM and reaches the hypervisor or other VMs |
| Resource reuse | Memory or storage released by one VM is allocated to another without being cleared |
| VM sprawl | Too many VMs are created and left unmanaged, unpatched and forgotten |
The hypervisor is the software that runs the VMs. A flaw in it is serious because it can affect every VM on the host.
Cloud specific vulnerabilities
Cloud risk is largely about configuration and shared responsibility. The provider secures the underlying platform, while the customer secures its own data, identities and settings.
Common issues include a storage bucket set to public access, weak identity and access management (IAM) policies, exposed keys and lack of logging. The provider's platform may be sound while the customer's configuration is not.
Supply chain vulnerabilities
The supply chain risk list names three groups of supplier.
| Supplier | Example of risk |
|---|---|
| Service provider | An outsourced provider with access to your systems is breached |
| Hardware provider | Devices arrive with counterfeit or altered components |
| Software provider | A trusted application or library contains malicious or vulnerable code |
A compromise at a supplier can spread to all customers. Defenses include vendor assessment, software integrity checks and limiting supplier access.
Mobile device vulnerabilities
| Issue | Meaning |
|---|---|
| Side loading | Installing apps from outside the official store, bypassing its checks |
| Jailbreaking | Removing manufacturer restrictions on an iOS device |
| Rooting | Gaining administrator access on an Android device |
A jailbroken or rooted device can no longer rely on built in protections. Mobile device management (MDM) policies can detect these states and block access to company data.
What to remember for the exam
- Firmware flaws are low level and hard to detect. Keep firmware updated.
- End of life and legacy hardware lack security fixes and need isolation or replacement.
- VM escape breaks out of a virtual machine. VM sprawl is unmanaged growth of VMs.
- Resource reuse in virtual environments can leak data from one VM to another.
- Cloud risk is mostly customer misconfiguration under the shared responsibility model.
- Supply chain risk covers service providers, hardware providers and software providers.
- Side loading, jailbreaking and rooting weaken mobile device security.
- MDM can detect jailbroken or rooted devices and enforce policy.
When a cloud question asks who is at fault for a publicly exposed storage bucket, the customer usually owns the configuration.
Common mistakes
Assuming the cloud provider secures everything. The provider secures the platform. The customer still owns data, accounts and settings.
Confusing VM escape with VM sprawl. One is an attack that breaks isolation. The other is an operations problem of too many unmanaged machines.
Treating firmware as part of the operating system. Firmware sits below it, so OS patches do not fix firmware flaws.
Mixing up jailbreaking and rooting. Jailbreaking is the term used for iOS, and rooting is the term used for Android.
Trusting a signed update without question. A supplier compromise can deliver a legitimate looking signature, so monitoring and vendor vetting still matter.
Hardware that is end of life may still run for years, but it quietly turns into a permanent weakness. Plan its replacement or isolation before support ends.
Check yourself
What is a VM escape?
An attack in which code running in a virtual machine breaks out and reaches the hypervisor or other virtual machines.
Which term describes installing an app from outside the official app store?
Side loading.
Under the cloud shared responsibility model, who is normally responsible for a storage bucket's public access setting?
The customer, because it is a configuration of the customer's own resources.
Topic 5 of 9 in Threats, Vulnerabilities, and Mitigations
Test yourself on Threats, Vulnerabilities, and Mitigations
The full CompTIA Security+ SY0-701 question bank has 848 questions, with timed practice exams and an explanation for every answer.
This study guide is independent and is not affiliated with, endorsed by, or sponsored by CompTIA. Vendor names, certification names and exam codes are trademarks of their respective owners and are used for identification only.