of public disclosure of security information by a certain party". Usually, vulnerability information is discussed on a mailing list or published on a security web site and results in a security advisory afterward. The time of disclosure is the first date a security vulnerability is described on a channel where the disclosed information on the vulnerability has to fulfill the following requirement: The information is freely available to the public The vulnerability information is published by a trusted and independent channel/source The vulnerability has undergone analysis by experts such that risk rating information is included upon disclosure Identifying and removing vulnerabilities Many software tools exist that can aid in the discovery (and sometimes removal) of vulnerabilities in a computer system. Though these tools can provide an auditor with a good overview of possible vulnerabilities present, they can not replace human judgment. Relying solely on scanners will yield false positives and a limited-scope view of the problems present in the system. Vulnerabilities have been found in every major operating system including Windows, macOS, various forms of Unix and Linux, OpenVMS, and others. The only way to reduce the chance of a vulnerability being used against a system is through constant vigilance, including careful system maintenance (e.g. applying software patches), best practices in deployment (e.g. the use of firewalls and access controls) and auditing (both during development and throughout the deployment lifecycle). Locations in which vulnerabilities manifest Vulnerabilities are related to and can manifest in: physical environment of the system the personnel (i.e. employees, management) administration procedures and security policy business operation and service delivery hardware including peripheral devices software (i.e. on premises or in cloud) connectivity (i.e. communication equipment and facilities) It is evident that a pure technical approach cannot always protect physical assets: one should have administrative procedure to let maintenance personnel to enter the facilities and people with adequate knowledge of the procedures, motivated to follow it with proper care. However, technical protections do not necessarily stop Social engineering (security) attacks. Examples of vulnerabilities: an attacker finds and uses a buffer overflow weakness to install malware to then exfiltrate sensitive data; an attacker convinces a user to open an email message with attached malware; a flood damages one's computer systems installed at ground floor. Software vulnerabilities Common types of software flaws that lead to vulnerabilities include: Memory safety violations, such as: Buffer overflows and over-reads Dangling pointers Input validation