Removing Vulnerabilities

Removing a vulnerability means repairing the weakness itself, so the route an attacker used is closed for good. That is not the same as blocking an attack while it happens: a firewall can turn traffic away today, but the gap in the software stays until somebody repairs it.

Action	How it removes the weakness
Install a software update	The update patches a bug in the program, replacing the faulty part, so a file crafted to exploit it no longer makes the program run hidden code
Put right what a penetration test found	The tester reached pupil timetables by shortening the web address, so the code now checks for a signed-in account before showing a page
Correct the way input is handled	Everything typed into a form is treated as text, so SQL typed into a team-name box is stored as a name instead of being run as a database command
Change firewall rules that allow traffic nobody needs	A rule left open for a repair engineer's laptop is deleted, so nothing outside can connect on that port any more
Run anti-malware	Software already on the machine that was quietly sending screenshots to an unknown address is found and deleted, so it cannot collect anything else

Each action is small, but together they take away the openings an attacker depends on. Blocking an attack leaves the weakness there for tomorrow; removing it leaves nothing to use.

Worked example

A youth theatre sells tickets through its website, looked after by a Year 12 helper. Testers change the number at the end of the web address and see another customer's order, so the code is changed to check each order belongs to the signed-in account. The helper installs the update the ticket software has been asking for, which patches a fault in the part that prints order slips, and deletes a firewall rule still letting any address reach the ticket server. Attacks continue, but the gaps they used have gone.

Worked example

Practise this