Respond agree or disagree Vulnerabilities in system design can be detrimental to any network, large or small any flaw that can be exploited should not be taken lightly. Engineers generally assume that mechanisms serve their intended purpose. Is that always true? The “smarter” something is, the quicker we lose control and become fully dependent on it (Trofimova & Hoske, 2016).   A vulnerability I found is a trust assumption and that is when a designer is aware of a security weakness and determining that a separate security control would compensate for it. However, trust assumptions are often implicit, such as creating a feature without first evaluating the risks it would introduce (Mozilla, 2018). This is something that when designing your system to not underestimate because as the article stated, these assumptions are often complicit and don't take every risk into account which could leave a window open to your system.  Another is always consider the users, this means when designing your network take into account the people that will be using it on a daily basis (IEEE, 2014) Every system is different and complex and therefore requires the designer to know who his users are. The security stance of a software system is inextricably linked to what its users do with it. It is therefore very important that all security-related mechanisms are designed in a manner that makes it easy to deploy, configure, use, and update the system securely. Remember, security is not a feature that can simply be added to a software system, but rather a property emerging from how the system was built and is operated (IEEE, 2014).  Trofimova, E., & Hoske, M. T. 1. [email protected] co. (2016). Retrieved from https://lopes.idm.oclc.org/login?url=http://search.ebscohost.com/login.aspx?direct=true&db=aci&AN=117494073&site=ehost-live&scope=site Mozilla. (2018). Vulnerabilities. Retrieved from https://developer.mozilla.org/en-US/docs/Web/Security/Information_Security_Basics/Vulnerabilities IEEE. (2014). Avoiding the top 10 software security design flaws. Retrieved from https://pdfs.semanticscholar.org/b291/be7d567d63dc60043a8cb1fbbfcfe8d18c83.pdf Respond agree or disagree System design vulnerabilities occurs very often and attackers or exploit hunters are always on the hunt for any opportunities that are presented.  During the process a product is being developed it is very important to incorporate cybersecurity and quality control teams. This incorporation has brought a new wave that I have seen and currently experiencing in my current role, DevOps. DevOps is a team where Developers and Operations work together to produce a finished product that has been through QA and cybersecurity teams have also made suggestions and participated during the production. Developers are great at what they do, but often they forfeit some security best practice to make something on their end work. Also, the risk of developers to forget, or simply disregard any input validation thro.

1. Respond agree or disagree
Vulnerabilities in system design can be detrimental to any
network, large or small any flaw that can be exploited should
not be taken lightly. Engineers generally assume that
mechanisms serve their intended purpose. Is that always true?
The “smarter” something is, the quicker we lose control and
become fully dependent on it (Trofimova & Hoske, 2016).
A vulnerability I found is a trust assumption and that is when a
designer is aware of a security weakness and determining that a
separate security control would compensate for it. However,
trust assumptions are often implicit, such as creating a feature
without first evaluating the risks it would introduce (Mozilla,
2018). This is something that when designing your system to
not underestimate because as the article stated, these
assumptions are often complicit and don't take every risk into
account which could leave a window open to your system.
Another is always consider the users, this means when
designing your network take into account the people that will be
using it on a daily basis (IEEE, 2014) Every system is different
and complex and therefore requires the designer to know who
his users are. The security stance of a software system is
inextricably linked to what its users do with it. It is therefore
very important that all security-related mechanisms are
designed in a manner that makes it easy to deploy, configure,
use, and update the system securely. Remember, security is not
a feature that can simply be added to a software system, but
rather a property emerging from how the system was built and is
operated (IEEE, 2014).
Trofimova, E., & Hoske, M. T. 1. [email protected] co. (2016).
Retrieved from
https://lopes.idm.oclc.org/login?url=http://search.ebscohost.com

2. /login.aspx?direct=true&db=aci&AN=117494073&site=ehost-
live&scope=site
Mozilla. (2018). Vulnerabilities. Retrieved
from https://developer.mozilla.org/en-
US/docs/Web/Security/Information_Security_Basics/Vulnerabili
ties
IEEE. (2014). Avoiding the top 10 software security design
flaws. Retrieved
from https://pdfs.semanticscholar.org/b291/be7d567d63dc60043
a8cb1fbbfcfe8d18c83.pdf
Respond agree or disagree
System design vulnerabilities occurs very often and attackers or
exploit hunters are always on the hunt for any opportunities that
are presented. During the process a product is being developed
it is very important to incorporate cybersecurity and quality
control teams. This incorporation has brought a new wave that I
have seen and currently experiencing in my current role,
DevOps. DevOps is a team where Developers and Operations
work together to produce a finished product that has been
through QA and cybersecurity teams have also made
suggestions and participated during the production.
Developers are great at what they do, but often they forfeit
some security best practice to make something on their end
work. Also, the risk of developers to forget, or simply disregard
any input validation through the process could lead to potential
security issues. The software is not the only place where these
vulnerabilities can occur, Product design (Infrastructure design)
can also provide vulnerabilities if controls are not followed.
Software Design Vulnerability

3. Vulnerabilities are caused because of poor design, configuration
mistakes, inappropriate and insecure coding techniques, the
complexity of software, unchecked user input, and weak
password management. (Kaur, N. & Kaur, P., 2014). With most
of the software offered as a SaaS, potential misconfigurations or
uncheck input validation can lead to various types of attack
such as the ones presented by OWASP. The most common are
SQL Injection, Cross-site scripting (XSS), or an insecure direct
object reference to name a few.
Network Architecture Vulnerability
During product design, Network security can be overlooked and
deem as not necessary, but no network architecture is
completely immune to unwanted intrusion. (INFOSEC INS.,
n.d.) If security is not incorporated during the product design
the network could be left vulnerable and various issues can
originate. Such vulnerabilities include cryptographic
vulnerabilities such as weak encryption, or wrong choice of
encryption, or even unsecured keys. Database vulnerabilities
such as Backup data, unauthorized copying of sensitive data.
Authentication and Access control vulnerabilities that deal with
the escalation of privileges, excessive privileges.
These all have to be taken into consideration when designing a
system and for the finish product design.
Kaur, N. & Kaur P. (2014). Input Validation Vulnerabilities in
Web Applications. Journal of Software Engineering, 8: 116-
126.DOI: 10.3923/jse.2014.116.126
INFOSEC Institute (n.d.). Security Architecture Vulnerabilities
and the CISSP. Retrieved from
https://resources.infosecinstitute.com/category/certifications-
training/cissp/domains/security-engineering/security-
architecture-vulnerabilities/#gref