Читать книгу You CAN Stop Stupid - Ira Winkler - Страница 55

Technical vulnerabilities can be software, hardware, or firmware based. They can also be vulnerabilities in equipment that cause injuries. Generally, with technical vulnerabilities, people assume they can bypass the users. However, we need to expand the discussion of technical vulnerabilities to include how technology is configured or maintained.

For example, poor passwords can be considered a technical vulnerability as they can be technically exploited by someone who guesses the passwords. This results in an external malicious attack directly against the computer, as the result of a technical vulnerability that was enabled by a user, who in turn was enabled to do so by their IT department, which happened to be governed by the existing policies of the organization. So, as you can see, the technical vulnerability is not just something that is inherent in the software or hardware independent of any user interaction. Users are involved at many levels.

As we are primarily interested in UIL, it is also important to recognize that technical vulnerabilities include the user interface design. While this can refer to computer interfaces, it can also refer to any interface on any piece of equipment. Such technology can cause users to initiate a loss. Interfaces can be confusing and almost force errors. For example, the DBIR highlights that a significant percentage of data breaches are caused by the email address autocomplete function filling in the wrong email address, after which sensitive data ends up being sent to the wrong person.

Generally, you can consider a technical vulnerability as anything in the organization's environment that can be exploited or can cause an error or damage. This is an important distinction to embrace as too many people are intimidated by the underlying technology (such as esoteric programming languages), but it is the surface technology (such as user interfaces) that they regularly interact with that can be the most damaging.