Security in Computing 5th Edition by Shari Lawrence Pfleeger, Charles P Pfleeger, Jonathan Margulies

Exercise 17

Developers often think of software quality in terms of faults and failures. Faults are problems, such as loops that never terminate or misplaced commas in statements, that developers can see by looking at the code. Failures are problems, such as a system crash or the invocation of the wrong function, that are visible to the user. Thus, faults can exist in programs but never become failures, because the conditions under which a fault becomes a failure are never reached. How do software vulnerabilities fit into this scheme of faults and failures? Is every fault a vulnerability? Is every vulnerability a fault?

Step 1 of 2

Software vulnerability:

A software is said to be vulnerable when it violates the security polices implicitly or explicitly. A software vulnerability is defined as an instance in the specification of a mistake.

Vulnerability is a single instance of mistake.

To test a system for failures, the vulnerabilities in requirements, design, and code are seen first. The vulnerabilities can be possible in all the three categories that are hardware, software, and data.

Refer to figure 1-4: vulnerabilities of computing Systems.