Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

Are all vulnerabilities security related? When people talk about vulnerabilities and security vulnerabilities, are they the same concept? My understanding is that a vulnerability is the a weakness in the system that allow to have potential attack.


3 Answers 3

This is one of those "it depends" situations. Systems are vulnerable to data loss due to power failure or disk drive failure or fire or water damage, for example, and so those could be considered "vulnerabilities" that are not "security related" because they do not result in unauthorized access to data or services or equipment and are not triggered on purpose by someone seeking to cause a denial of service. Then again, if the equipment in question is, say, operating a nuclear power plant, then equipment failure becomes a security problem of a different sort. So it really depends on what you define as a vulnerability and what you define as security.

I think of security vulnerabilities as things that would allow someone to cause unintended operation of a system (which includes unauthorized access or denial of service). I think of vulnerabilities in general as anything which would interfere with the proper operation of a service. So I would say "no", not all vulnerabilities are security related.


First if we ask what is security and what are we protecting, then we can realize that what vulnerability is. All vulnerabilities are security related, including all technical and non technical aspects.

If something is threatening confidentiality, integrity and availability in any aspect then it will be considered as a vulnerability. A vulnerability cannot exist without the need of securing something.

In simple words a vulnerability is anything that can possibly affect confidentiality, integrity and availability (CIA) by it's possibility of occurrence.


Look at Information Security describing the basic principles. Basic principles - Key concepts The CIA triad (confidentiality, integrity and availability) is one of the core principles of information security.

We are so caught up in the idea "Security" means its has to be some flaw in IT (server, software, network). But at the deeper fundamental level "Security" is protecting information from any possible threat, technical or non technical, irrespective of probability. This leads to RM and BC. Any threat to confidentiality, integrity and availability (CIA) in an environment is an vulnerability. Even an earthquake is a threat to Availability of the information, the information has to be Secured or protected, the information on the server is vulnerable to earthquake. Security is more than just preventing unauthorized access, unauthorized use or alteration of data.

I disagree. I don't think the fact that an e-commerce site could become unavailable due to an earthquake that causes physical damage to the data center housing the site's servers (e.g. cutting the cables providing internet connectivity) is a security vulnerability. I think security means protection against a malicious adversary, not every possible thing that could go wrong. –  Major Major Jun 13 '12 at 8:54
@MajorMajor - I updated my answer with more explanation. –  Kapish M Jun 13 '12 at 9:21
You and I have a basic difference of opinion. I respect your opinion, I just disagree with it. While availability is a useful goal, for example, banking systems are typically unavailable for routine "maintenance" several hours a week. I don't think that makes them insecure. Because the class of protections/countermeasures are so different and specialized with regard to protecting against a malicious adversary compared to guarding against ordinary failures of the physical world, I prefer to reserve "security" for the former and use "reliability" for the latter. –  Major Major Jun 13 '12 at 9:45
@MajorMajor - "Maintenance" is not a threat to "availability" as in making it insecure, since it is a planned action. Someone tripping on a network cable and bringing the server offline for 10 mins is, affecting the availability, physical vulnerability, physical security. –  Kapish M Jun 13 '12 at 9:53

I think that a vulnerability

("Vulnerability refers to the inability to withstand the effects of a hostile environment")

implies insecurity, so all vulnerabilities are security related.


This site is currently not accepting new answers.

Not the answer you're looking for? Browse other questions tagged .