Technology, Configuration or Policy?

About this interactive

The lesson's three types of vulnerability: - **Technological:** a weakness in the technology itself: the operating system, the firmware, a program, or a protocol. Nobody set it up wrong; it shipped that way, and the fix comes from the vendor. - **Configuration:** the technology is sound but set up badly: a default username and password left in place, encryption turned off or weak, a service exposed that should not be. The lesson's author meets these most often. - **Security policy:** the rules are missing, vague, incomplete, never taught to staff, or not enforced. Software weaknesses run a life cycle: found and used quietly as a zero-day, published in the CVE list, then patched. Patching often keeps that window short.

What you'll learn

Classify a weakness as a technological vulnerability (built into the hardware, software or protocol), a configuration vulnerability (how it was set up) or a security policy weakness (the rules, or how they are kept)
Recognize the lesson's examples in practice: firmware and protocol flaws, default passwords and weak encryption settings, and policies that are missing, vague, untaught or unenforced

Aligned to

Cisco CCST Cybersecurity

1.2 Explain common threats and vulnerabilities.

4.1 Explain vulnerability management

Key terms

Vulnerability: A weakness in a system, application, or process that can be exploited by a threat actor.
Security Policy: A formal document that defines an organization's security goals, rules, and responsibilities.
Configuration Management: The process of tracking and controlling changes to hardware, software, and documentation throughout a system's lifecycle.
Default Credentials: Factory-set usernames and passwords that ship with network devices, applications, and services. Default credentials must be changed immediately upon deployment because they are publicly documented and frequently targeted by automated attackers.
Patch Management: The process of acquiring, testing, and installing software updates to fix vulnerabilities and improve functionality.

Topics

Vulnerability Configuration Security Policy Security Basics Interactive Categorize

About TechKnowSurge

TechKnowSurge builds IT and cybersecurity professionals through hands-on, concept-first training built around real understanding — not memorization. Free interactive tools, structured programs, and 25+ years of real-world experience, all in one place.

Explore free tools and programs →