What is a vulnerability?

A lot of people have tried to define the word ‘vulnerability’ and how it relates to the security industry. The best definition though is how it relates to world at large. The below is a modified version of Microsoft’s definition of a vulnerability, written by Scott Culp.

“A vulnerability is any flaw that makes it infeasible, even when implemented or used properly, to prevent an attacker from; usurping privileges, regulating internal protected operations, compromising data, or assuming trust that was not explicitly granted.”

This definition allows are a wide range of things to be classified as vulnerabilities. It includes everything from the LSASS Buffer Overflow to characters flaws that allow for easy social engineering. This makes sense as vulnerabilities have been around since the beginning of time and have existed in every device or idea that was created to restrict or moderate access.