Vulnerabilities in IT systems fall into three categories—technological, configuration, and security policy weaknesses—each capable of exposing critical assets to threats. Understanding how vulnerabilities emerge and progress through their life cycle, from zero-day discovery to CVE publication and patching, is essential for managing risk effectively.
Vulnerabilities Deep Dive
In our example here, we have an asset that we want to protect. In this case it is some sort of data, and we put up walls around it and we put up a gate so that not just anybody can come by — the hacker can't come by and just grab that data and run off with it. But these technologies that we use, this wall and this gate, have some sort of vulnerabilities to them.
An example is that there is a lock on this gate, and that lock can be picked or broken to open up the gate and get inside of it. Or the gate itself is not as strong as the wall, so the gate can be broken down and that way a hacker could get to this data. Or perhaps there's no ceiling on this structure that we have here, so perhaps there's a way they can scale the wall and get in to get to the data. Or, depending on what the ground is like, maybe they can tunnel underneath to get to this data. These are vulnerabilities that give some exposure to this data of getting out, and susceptible to this threat.
There are three types of vulnerabilities that we have. First of all is a technological vulnerability: an inherent problem with the technology that allows for this vulnerability to be available to a hacker. We also have the configuration vulnerability — if things are not configured correctly, if somebody leaves the gate open, they leave the gate open. So there's a configuration vulnerability that we have with different technologies. And then we have the security policy itself. This is the rules that we set up to govern how we operate, and there are some weaknesses in how we approach some of that as well.
In our example, we said some of the vulnerabilities are the lock on the gate, the gate itself, and going over or under the wall. So there are perhaps some technological vulnerabilities to having this wall and this gate around this data.
It's the same thing with equipment. When you set up equipment, there are some weaknesses in the operating system or the firmware that's operating this equipment. There are programs that are on that hardware, and the programs themselves have weaknesses to them. Or perhaps those programs are using different protocols, and certain protocols have certain weaknesses to them. So there are weaknesses throughout all of this. From a technological standpoint, your networking equipment can have weaknesses that are built into it at multiple levels here.
Then we have a configuration weakness, because your devices and your technologies have operating systems, they have software that's installed on them, they have services that are running on them. They come with all of this stuff to make them operate, and there are lots of configurations that can happen on there. So maybe it's not a weakness in the software itself, but in how you configure that software.
The example here would be: let's say you walk away and you leave the gate open, or maybe you leave it unlocked — then any hacker can come by and access that data. It's the same thing on your computer. If you walk away from your computer and it's open and you're on a piece of equipment, somebody can come by, sit down, install their own credentials on the system, and now they're in. And they don't even necessarily need to install their credentials on there. Maybe you get a piece of equipment that has a default username and password, and you don't reconfigure it to something more secure, and now anybody can get onto that device and start leveraging that device. Perhaps there is some software or some data that's supposed to be encrypted, and you don't encrypt it, or you do poor encryption on it, and now that is vulnerable to the outside world.
There are lots of examples of this, and really, out of the three of these — technological, configuration and security policy — I run into more issues with configuration than anything else. Let me say that again. From a triad experience, confidentiality, integrity and availability, I have more issues with people misconfiguring the equipment and having that data or that equipment exposed to the outside world than anything else. So this is one to really watch out for, and it's one that really needs a lot of controls around it to make sure that you're doing this correctly. Watch out for this configuration.
Then there are weaknesses in your security policies. Your security policies are rules, guidelines, procedures — a bunch of things that you will set up and instruct your employees to do to make sure that we are not opening up any kind of issues on our networks, and any kind of issues that are opening up our assets to threats. What can happen is you could just lack these altogether: maybe you don't have any security policies at all. Or maybe those policies exist, they're just not clear, or they're not specific enough. Or perhaps you're not educating people on those security policies. Maybe they're incomplete and they're only halfway written. Maybe people know what the security policy is, they just don't follow it — and that I've definitely seen in companies a lot before. If you don't have some sort of policy enforcement, where you're actively trying to seek out whether people are following your policies or not, you will have people that don't follow those policies. Security policy is one that I think is overlooked in a lot of companies.
Out of these, I would rank configuration as probably having been our biggest problem in the past, at the places that I've worked. Lack of security policy would be second, and then there's the technological, and we will get more into some of the technological issues with networking equipment and different protocols.
It starts out as these updates get released, and at this point in time it's not really well known. A hacker comes along and they may discover this at this point in time. This is called zero day: it's when the hacker understands a vulnerability and can leverage the vulnerability, but it's not widely known. Not everybody knows about this vulnerability yet.
But over time, this vulnerability gets broadcast out and more and more people realize that this vulnerability is out there. The next stage of this is that it goes into the CVE, or the common vulnerabilities and exposures. This is a list of all of the exposures and vulnerabilities that are out there, and this is a good thing in some ways. What happens is that now more hackers will know about this vulnerability. But on the flip side, now that it's been sent out into the public and people are aware of it, the companies that have released the hardware or software can go now and fix their hardware and software. They come out with a patch. So the next stage in this life cycle is that there are patches and updates that come out to do away with this vulnerability.
One thing that you want to do with this is limit your exposure. You want to limit the time that it's in these two stages here, and you do that by patching often, by making sure that you're using vendors that are still supporting their hardware and their software, and by making sure that you are up to date with your licensing so you can continue to get these patches and updates.
TechKnowSurge builds IT and cybersecurity professionals through hands-on, concept-first training built around real understanding — not memorization. Free interactive tools, structured programs, and 25+ years of real-world experience, all in one place.
Explore free tools and programs →