Cloud 101CircleEventsBlog
Missed CSA's Cyber Monday sale? You can still get 50% off the CCSK + CCZT Exam & Training Bundle and Token Bundle with raincheck code 'rcdoubledip24'

Research Topic

Vulnerabilities

Top 10 Blockchain Attacks, Vulnerabilities & Weaknesses
Top 10 Blockchain Attacks, Vulnerabilities & Weaknesses

Download

Vulnerabilities
What is a vulnerability? How are they different from software bugs?
Vulnerabilities are different when compared to other software bugs for one simple reason: they don’t expose themselves and change the state of the system until someone triggers them intentionally. Even when the system state changes to a less secure state (e.g., exposing information), the attacker still needs to take advantage of it. In other words, it isn’t just enough to find a buffer overflow, the attacker must develop a malicious payload that can exploit it and execute the code they want.

Vulnerabilities require interacting with them to have any proof that they really are a vulnerability. If an attacker has to have knowledge of a vulnerability in order to exploit it, then it stands to reason that the defenders also have to have knowledge of the vulnerability in order to fix it. While one could make the argument that defenders must monitor your systems for compromise, and when exploited investigate and fix the problem, I think it might be more efficient to first try letting defenders know about what vulnerabilities may exist so they can take corrective action in advance of being attacked. To learn more about vulnerabilities read this blog

How does the cloud change how we track vulnerabilities?
Given the increase in successful attacks against all forms of IT infrastructure it has become obvious that current efforts to track vulnerabilities using vulnerability identifiers has reached its limit. Identifiers need to be easily discovered, fast to assign,updatable, and publicly available. The number of vulnerabilities is growing faster than we are currently able to track them. As an industry we need to start talking about how to solve this problem. One way you can do this is by joining the Global Security Database Working Group. Come help us build the best vulnerability identifier out there!

View the Global Security Database CSA created to track vulnerabilities.
CSA created the https://GlobalSecurityDatabase.org, which is building a community and processes that will result in a much better dataset than CVE has, where false positives can easily be challenged, and it will be free for use. We have a really good entry for CVE-2021-44228 if you are interested.

VulnerabilitiesVulnerability Data

Webinars

Riding the OpenSource Security Rollercoaster
Riding the OpenSource Security Rollercoaster

February 16 | Online

Learn more

Risk Management in 2022: Take it Up a Notch
Risk Management in 2022: Take it Up a Notch

March 2 | Online

Learn more

Securing the Data and AI Landscape with DSPM and DDR
Securing the Data and AI Landscape with DSPM and DDR

October 3 | TBD

Learn more

Cyber Attacks: It's not if, It's when! Why aren't we prepared?
Cyber Attacks: It's not if, It's when! Why aren't we prepared?

October 10 | Online

Learn more

Blog Posts

Vulnerability Management Isn't About Finding Issues — It's About Fixing Them in Context
AI-Enhanced Penetration Testing: Redefining Red Team Operations
What 2024’s SaaS Breaches Mean for 2025 Cybersecurity