Vulnerabilities

A vulnerability is a weakness in a computer system or network that an attacker could exploit. It is not the same as an attack: the vulnerability is the opening, and the attack is the method used to get through it. A window left open is a vulnerability; someone climbing through it is the attack. Closing the window removes the weakness, which is different from blocking an attacker in the moment.

Vulnerabilities usually fall into three groups.

• Software vulnerabilities: bugs in a program, or software that has not been patched (updated to fix known bugs). A bug in a school's quiz site might let a pupil see the correct answers before the test starts. Unpatched software is risky because the flaw is already known and attackers may have instructions for using it.
• User account vulnerabilities: weak passwords, shared accounts, or accounts with more permissions than the job needs. If a whole department logs into one shared account, nobody can tell who did what, and one leaked password exposes everyone's files. A temporary cover teacher given control of the entire network can reach far more than the role requires.
• Physical access vulnerabilities: unlocked doors, unattended devices and screens left visible. A tablet left on a reception desk is open to anyone walking past, and a screen showing a pupil record can be read over someone's shoulder.

Finding and fixing vulnerabilities

Organisations should identify vulnerabilities and remove them. Identifying means checking what is actually there: which software versions are installed, which accounts exist and what each can reach, and whether doors and devices are secure. Removing means fixing what you find, for example installing updates, deleting unused accounts, reducing permissions to what a role needs, and locking rooms that hold equipment.

New flaws appear over time, so identifying and fixing must be ongoing. Organisations also apply prevention methods to limit threats, such as anti-malware software, firewalls, encryption and physical security, so an attack is less likely to succeed and any damage is smaller. Several methods are used together, because no single one covers every weakness.