Cloud 101

Research Topic


Latest Research
Top 10 Blockchain Attacks, Vulnerabilities & Weaknesses
Top 10 Blockchain Attacks, Vulnerabilities & Weaknesses


What is a vulnerability? How are they different from software bugs?
Vulnerabilities are different when compared to other software bugs for one simple reason: they don’t expose themselves and change the state of the system until someone triggers them intentionally. Even when the system state changes to a less secure state (e.g., exposing information), the attacker still needs to take advantage of it. In other words, it isn’t just enough to find a buffer overflow, the attacker must develop a malicious payload that can exploit it and execute the code they want.

Vulnerabilities require interacting with them to have any proof that they really are a vulnerability. If an attacker has to have knowledge of a vulnerability in order to exploit it, then it stands to reason that the defenders also have to have knowledge of the vulnerability in order to fix it. While one could make the argument that defenders must monitor your systems for compromise, and when exploited investigate and fix the problem, I think it might be more efficient to first try letting defenders know about what vulnerabilities may exist so they can take corrective action in advance of being attacked. To learn more about vulnerabilities read this blog

How does the cloud change how we track vulnerabilities?
Given the increase in successful attacks against all forms of IT infrastructure it has become obvious that current efforts to track vulnerabilities using vulnerability identifiers has reached its limit. Identifiers need to be easily discovered, fast to assign,updatable, and publicly available. The number of vulnerabilities is growing faster than we are currently able to track them. As an industry we need to start talking about how to solve this problem. One way you can do this is by joining the Global Security Database Working Group. Come help us build the best vulnerability identifier out there!

View the Global Security Database CSA created to track vulnerabilities.
CSA created the, which is building a community and processes that will result in a much better dataset than CVE has, where false positives can easily be challenged, and it will be free for use. We have a really good entry for CVE-2021-44228 if you are interested.

VulnerabilitiesGlobal Security Database (GSD)

Discuss this topic in Circle

View discussion community


Risk Management in 2022: Take it Up a Notch
Risk Management in 2022: Take it Up a Notch

March 2 | Online

Learn more

Riding the OpenSource Security Rollercoaster
Riding the OpenSource Security Rollercoaster

February 16 | Online

Learn more

Blog Posts

On the Criticality of SDLC Context for Vulnerability Remediation
DuckLogs – New Malware Strain Spotted In The Wild
The Discovery of a Massive Cryptomining Operation Leveraging GitHub Actions