Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

I'm looking for a list of what you would consider to be the Top Ten Security Weaknesses of a Networked Computer, can be Windows or Linux specific but ones that apply to both are better.

I'm not as interested in particular vulnerabilities (aka not answers like MS08-67), rather generic attack vectors which could feature a vulnerability.

Many Thanks, -Tech

share|improve this question
    
This question does seem very "open" to me, with widely varying answers based on the exact situation the networked computer is in. –  Terry Chia Jun 12 '12 at 10:47
    
By intention, I'm looking for a wide variety of responses instead of one particular answer :) –  Technosites Jun 12 '12 at 11:02
2  
This may be too open, which is not generally a good fit for SE sites. Please have a look at the FAQ - looking for one particular answer fits a lot better. I have a feeling this might get voted as too subjective or too localised, and then closed. Will wait and see. –  Rory Alsop Jun 12 '12 at 11:17
add comment

closed as not a real question by AviD Jun 12 '12 at 12:54

It's difficult to tell what is being asked here. This question is ambiguous, vague, incomplete, overly broad, or rhetorical and cannot be reasonably answered in its current form. For help clarifying this question so that it can be reopened, visit the help center.If this question can be reworded to fit the rules in the help center, please edit the question.

1 Answer

up vote 3 down vote accepted

I only came up with 5 so far.

Here is my list in no particular order:

1. Security Misconfiguration (OWASP Top 10)

Good security requires having a secure configuration defined and deployed for the 
application, frameworks, application server, web server, database server, and platform. 
All these settings should be defined, implemented, and maintained as many are not 
shipped with secure defaults. This includes keeping all software up to date, including 
all code libraries used by the application.

2. Insufficient transport layer protection (OWASP Top 10)

Applications frequently fail to authenticate, encrypt, and protect the confidentiality 
and integrity of sensitive network traffic. When they do, they sometimes support weak 
algorithms, use expired or invalid certificates, or do not use them correctly.

This allows for packet sniffing.

3. Zero day exploits in software

Networked machines usually provide some kind of service, whether it be a SQL server, 
webserver or FTP server. Vulnerabilities in software will always be a threat as software 
never be developed without security issues.

Vulnerabilities that come under this is for example:
* SQL injection on a database
* XXS on a webserver
* Buffer overflow attacks on an application
* Format string attacks
* ...

4. Hijacking / Spoofing / Session replay

If a middleman is in some way able to observe the traffic between two nodes on a network 
he may try to capture the traffic, modify it and appear as the sender. 

Techniques such as ARP Poisoning comes unde rthis category.

5. Denial of service

Disruption of service by some kind of resource starvation on the victim. I.e packet 
flooding to consume all half-open TCP connections or consuming all bandwith on a 
webserver.
share|improve this answer
    
Great response thanks. I guess 2-5 cover the network aspect of the vulnerability surface , I wonder if we could identify some more which are weaknesses on the client/OS side :) –  Technosites Jun 12 '12 at 11:04
add comment

Not the answer you're looking for? Browse other questions tagged or ask your own question.