CCSP · Question #129
The Open Web Application Security Project (OWASP) Top Ten is a list of web application security threats that is composed by a member-driven OWASP committee of application development experts and…
The correct answer is B. The particular vulnerabilities only exist in a context not being used by developers. Organizations might unknowingly or knowingly use components with known vulnerabilities if they believe the specific vulnerable context or attack vector is not present in their particular usage scenario.
Question
The Open Web Application Security Project (OWASP) Top Ten is a list of web application security threats that is composed by a member-driven OWASP committee of application development experts and published approximately every 24 months. The 2013 OWASP Top Ten list includes "using components with known vulnerabilities." Why would an organization ever use components with known vulnerabilities to create software?
Options
- AThe organization is insured.
- BThe particular vulnerabilities only exist in a context not being used by developers.
- CSome vulnerabilities only exist in foreign countries.
- DA component might have a hidden vulnerability.
How the community answered
(55 responses)- A18% (10)
- B73% (40)
- C5% (3)
- D4% (2)
Why each option
Organizations might unknowingly or knowingly use components with known vulnerabilities if they believe the specific vulnerable context or attack vector is not present in their particular usage scenario.
Insurance might cover some losses, but it does not mitigate the security risk or explain why an organization would deliberately introduce known vulnerabilities.
A component might have a known vulnerability, but that vulnerability may only manifest under specific conditions, configurations, or attack vectors that are not exploited or even present in how the organization integrates and uses the component. Developers might incorrectly assess that their particular usage of the component is outside the scope of the known vulnerability, leading them to deploy it.
The geographic location of a vulnerability is not a determining factor; vulnerabilities exist irrespective of country borders in the context of software.
While components *can* have hidden vulnerabilities, the question specifically refers to "known vulnerabilities," implying that the presence of the flaw is already public.
Concept tested: Software supply chain security risks
Source: https://owasp.org/www-project-top-ten/
Topics
Community Discussion
No community discussion yet for this question.