Describe the difference between a vulnerability and an exposure.

• A. A vulnerability is a weakness that can be exploited; exposure is potential exposure of data or assets that may be at risk.
• B. A vulnerability is a patch; exposure is a fix.
• C. A vulnerability is a firewall rule; exposure is a network segment.
• D. A vulnerability is a type of malware; exposure is encryption.

Answer: (A)

A vulnerability is a flaw in a system, software, or process—the weakness that could be exploited by an attacker to cause harm or gain unauthorized access. Exposure is the risk state of data or assets being at risk because of that flaw or weak controls—the potential for sensitive information or resources to be exposed if the vulnerability is exploited.

So a missing patch creates a vulnerability, while the fact that sensitive data could be exposed if that vulnerability is exploited represents the exposure. Patches are remedies to close vulnerabilities; firewall rules, network segments, and encryption are protective measures, not definitions of vulnerability or exposure.