Bought Application or Our Own Code?

About this interactive

What you are doing: deciding whether a security concern belongs to a business application the company bought or to software it develops itself. The lesson splits software vulnerabilities in two. With a purchased business application, such as video conferencing, the vendor should take care of its code. The company evaluates the vendor's security before buying, sets the application up so there are no holes, changes default credentials, turns off what it does not use, keeps it patched, and makes sure updates come from the right source, because a malicious update can carry its own problems. When the company writes code in-house, there is a whole other set of concerns: buffer overflows, injection such as SQL injection, secrets embedded in the code, poor exception handling, race conditions, cross-site scripting, and the third-party libraries the code depends on. How to use it: ask who wrote the code at fault. A vendor's product the company runs is bought; the company's own developers' code is built in-house. A wrong answer resets your streak and shows the right bin; land five in a row to finish.

What you'll learn

Tell a security concern that comes with a purchased business application (vendor evaluation, configuration, default credentials, patching, malicious updates) from one that comes with software developed in-house (buffer overflows, injection, embedded secrets, poor exception handling, race conditions, cross-site scripting, third-party libraries)

Aligned to

CompTIA Security+

2.3 Explain various types of vulnerabilities.

Key terms

Misconfiguration: An incorrect or insecure system or service setting made by an administrator that can expose vulnerabilities affecting confidentiality, integrity, or availability.
Malicious Update: A software update that has been tampered with or compromised to deliver malicious code to systems that install it.
Default Credentials: Factory-set usernames and passwords that ship with network devices, applications, and services. Default credentials must be changed immediately upon deployment because they are publicly documented and frequently targeted by automated attackers.
Buffer Overflow: A software vulnerability that occurs when a program writes more data to a fixed-size memory buffer than it can hold, overwriting adjacent memory. Attackers exploit buffer overflows to crash programs or execute arbitrary malicious code.
SQL Injection: An attack that inserts malicious SQL code into a query to manipulate a database.
Race Condition: A software vulnerability that occurs when a system's behavior depends on the timing or sequence of events — an attacker who can manipulate the window between a time-of-check and a time-of-use can alter the outcome in their favor.

Topics

Misconfiguration Malicious Update Default Credentials Buffer Overflow Sql Injection Race Condition Interactive Streak Sort

About TechKnowSurge

TechKnowSurge builds IT and cybersecurity professionals through hands-on, concept-first training built around real understanding — not memorization. Free interactive tools, structured programs, and 25+ years of real-world experience, all in one place.

Explore free tools and programs →