Northreach's catalogue server runs an application framework that is eleven months behind on security patches, and a public exploit for that version exists. Which term names the unpatched framework itself?

Answer

The vulnerability — a flaw or weakness that could be exploited

Options - A. The vulnerability — a flaw or weakness that could be exploited - B. The threat — a potential for a violation of security - C. The risk — an expectation of loss from impact and likelihood - D. The attack — an assault deliberately mounted on the system - E. The exposure — sensitive data released to an unauthorized entity Why - A. Correct — a vulnerability is a property of the system: a flaw in design, implementation, operation or management that could be exploited. - B. The threat is the *potential* that the flaw is exploited. The flaw is not the potential; it is what the potential acts on. - C. Risk is an expectation of loss computed over impact and likelihood. It is a quantity about the situation, not a component of it. - D. The attack is the exploit request when it actually arrives. Nothing has been mounted yet in this scenario. - E. Exposure is a threat action under unauthorized disclosure, not a name for a software flaw.

Stallings & Brown 5e ch1 §1.2; RFC 4949