Most Important Cybersecurity Vulnerability Facing IT Managers Today: You and I Cybersecurity vulnerabilities in the early years generally revolved around problems with computer hardware and software with no solid definition of what a vulnerability really was, much less which vulnerability would take home the “Most Important Vulnerability” title. In his thesis proposal on “Computer Vulnerability Analysis”, Krsul (1997, p. 2) starts his “Definition of Vulnerability” section by delving into the fact that there was no industry accepted definition that precisely defines “computer vulnerability.” Krsul goes on to ask us to review three of the most commonly accepted definitions of the day—remember, this is 1997!—that he will use to form the basis of this thesis (Krsul, 1997, pp. 2-3):
1. Bishop and Bailey define a vulnerability as “a characterization of a vulnerable state which distinguishes it from all non-vulnerable states.” (Bishop & Bailey, 1996, p. 2). Their report focuses on computer vulnerabilities from a state configuration view where computers are state devices, and a vulnerability is any flaw in software that allows a user (whether authorized or unauthorized) to transition the system from an “authorized state” to an “unauthorized state.” We commonly reference these types of vulnerabilities today as buffer overflow vulnerabilities, input validation vulnerabilities, improper system configuration, etc.
2. Longley and Shain define a vulnerability using several different methods.
"1) In computer security, a weakness in automated systems security procedures, administrative controls, Internet controls, etc., that could be exploited by a threat to gain unauthorized access to information of to disrupt critical processing. 2) In computer security, a weakness in the physical layout, organization, procedures, personnel, management, administration, hardware or