Why attack prevention, defense and threat mitigation are separate tags?

Question

What is the difference between attack-prevention, defense and threat-mitigation? Should they be merged? I'm not sure that difference outlined by @AviD worth having separate tags

Answer 1

To my mind, they do seem to be different enough, even if only slightly.

attack-prevention would be regarding a specific attack vector - e.g. how do I prevent an attacker from exploiting XSS. Or how can I ensure I'm safe from SYN attacks.

On the other hand, defense would be the more general, solid construction types of questions. This is more of a mindset shift, e.g. how to defend against the unknown, etc.

In OWASP nomenclature, this would be Breakers (and specific countermeasures) vs. Builders.

Answer 2

All three describe ways of addressing risk.

"Mitigation" involves reducing damage from a successful attack, without necessarily making an attack less likely to succeed. For example,

• I can mitigate the effect of stolen keys by rotating keys frequently,
• I can mitigate the effect of stolen passwords by using different passwords for different sites,
• I can mitigate the effect of XSS by not associating cookies with the domain in which the script is run.

The common thread here is that mitigation doesn't necessarily reduce the effort it takes to attack, but does reduce the loss due to an attack.

"Defense" includes both attack prevention and mitigation -- both making an attack more expensive to execute and making the losses less severe count as defense.