Threats, Vulnerabilities, and Attacks · Topic 1 of 10
Characteristics of Threats and Vulnerabilities
Security+ threat and vulnerability basics: threat feeds, intelligence sources and life cycle, likelihood and impact, CVE, CVSS scoring and prioritizing.
- 5 min
- A threat acts, a vulnerability is the weakness, and risk combines likelihood and impact.
- Intelligence sources include OSINT, commercial feeds, sharing groups, government, the dark web and internal data.
- A threat feed is a stream of indicators that tools can import. STIX is the format and TAXII is the transport.
What it is
A threat is anything that could cause harm, such as an attacker, a malware campaign or a mistake. A vulnerability is a weakness that a threat can use. Risk appears where a threat meets a vulnerability on something of value.
This page covers how threats are described and tracked, and how vulnerabilities are named, scored and put in order for fixing. It is the vocabulary the rest of the chapter builds on.
How it works
Likelihood and impact
Two questions describe any threat. Likelihood is how probable it is that the threat will act against you. Impact is how much damage it would cause if it did.
| Factor | What raises it |
|---|---|
| Likelihood | The flaw is public, an exploit exists, the system faces the internet, attackers are known to target your sector |
| Impact | The system holds sensitive data, supports a critical process, or is hard to restore |
A threat that is likely but harmless and a threat that is severe but very unlikely both rank below one that is likely and severe. Risk is often expressed as likelihood multiplied by impact.
Intelligence sources
Threat intelligence is information about who attacks, how and with what tools. It comes from several kinds of source.
| Source | Examples |
|---|---|
| Open source intelligence (OSINT) | Public reports, vendor blogs, social media, public vulnerability lists |
| Commercial or proprietary | Paid services from security vendors |
| Information sharing groups | Industry groups such as Information Sharing and Analysis Centers (ISACs) |
| Government | National cyber agencies that publish alerts and advisories |
| Dark web | Forums and markets where stolen data and tools are traded |
| Internal | Your own logs, incidents and detections |
Internal data is often the most relevant, because it shows what is actually happening to your own systems.
Threat feeds
A threat feed is a continuous stream of threat data, such as malicious IP addresses, domains and file hashes. Security tools can import a feed and block or alert on what it lists.
Feeds are often shared in standard formats. Structured Threat Information eXpression (STIX) describes the data, and Trusted Automated eXchange of Intelligence Information (TAXII) carries it between systems.
The intelligence life cycle
Threat intelligence is produced in a repeating cycle, so it stays aimed at what the organization needs.
Feedback starts the next round. Raw data that is never analyzed or shared with the people who act on it is not useful intelligence.
Naming vulnerabilities: CVE
Common Vulnerabilities and Exposures (CVE) is a public list that gives each known flaw a unique identifier, such as CVE-2021-44228. The identifier lets scanners, vendors and analysts talk about exactly the same flaw.
A CVE entry names a specific flaw in a specific product. It does not say how severe the flaw is.
Scoring vulnerabilities: CVSS
The Common Vulnerability Scoring System (CVSS) rates the technical severity of a flaw from 0 to 10. The score is built from metrics such as how the flaw is reached, how complex the attack is, what privileges and user interaction it needs, and its effect on confidentiality, integrity and availability.
| CVSS score | Severity |
|---|---|
| 0.0 | None |
| 0.1 to 3.9 | Low |
| 4.0 to 6.9 | Medium |
| 7.0 to 8.9 | High |
| 9.0 to 10.0 | Critical |
Prioritization
The CVSS score alone does not decide what to fix first. Context changes the order.
- Exploitation: a flaw that attackers are already using, such as one listed in a known exploited vulnerabilities catalog, comes first.
- Exposure: an internet facing system ranks above an isolated one.
- Asset value: a system that holds sensitive data or runs a critical process ranks higher.
- Compensating controls: existing protections may lower the real risk.
Vulnerability types
Vulnerabilities are grouped by where the weakness lives, which also suggests the fix and the owner.
| Type | Usual fix |
|---|---|
| Software or code flaw | Patch or update |
| Misconfiguration | Correct the setting, apply a secure baseline |
| Hardware or firmware flaw | Firmware update, replacement or compensating controls |
| Cryptographic weakness | Move to current algorithms and key lengths |
| Human or process weakness | Training and better procedures |
The other pages of this chapter describe these types in detail.
What to remember for the exam
- A threat acts, a vulnerability is the weakness, and risk combines likelihood and impact.
- Intelligence sources include OSINT, commercial feeds, sharing groups, government, the dark web and internal data.
- A threat feed is a stream of indicators that tools can import. STIX is the format and TAXII is the transport.
- The intelligence life cycle runs from requirements through collection, processing, analysis and dissemination to feedback.
- CVE names a flaw. CVSS scores its severity from 0 to 10.
- Prioritize with CVSS plus exploitation, exposure and asset value.
If a question asks which flaw to fix first, look for the one that is actively exploited and exposed, not simply the highest score.
Common mistakes
Mixing up CVE and CVSS. CVE is the name or identifier of the flaw. CVSS is its severity score.
Treating the CVSS score as the whole risk. The base score describes the flaw, not your environment, so exposure and asset value still matter.
Confusing a threat with a vulnerability. A ransomware gang is a threat. The unpatched server it targets is the vulnerability.
Collecting feeds without analysis. A large feed nobody reviews or tunes produces noise, not intelligence.
Check yourself
What is the difference between CVE and CVSS?
CVE gives a flaw a unique identifier, while CVSS rates how severe it is on a scale from 0 to 10.
Which two factors combine to describe the risk of a threat?
Likelihood and impact.
A CVSS 6.5 flaw is being exploited on an internet facing server, and a CVSS 9.0 flaw sits on an isolated lab system. Which should usually be fixed first?
The exploited, internet facing 6.5 flaw, because context such as exploitation and exposure drives priority.
Topic 1 of 10 in Threats, Vulnerabilities, and Attacks
Test yourself on Threats, Vulnerabilities, and Attacks
The full CompTIA Security+ SY0-801 question bank has 998 questions, with timed practice exams and an explanation for every answer.
This study guide is independent and is not affiliated with, endorsed by, or sponsored by CompTIA. Vendor names, certification names and exam codes are trademarks of their respective owners and are used for identification only.