Vulnerability, we all have heard this word very often in these days due to the covid pandemic, and
there are a lot of vulnerabilities now.
What actually is a vulnerability?
Well, weakness of an asset or control that can be exploited by one or more threats is vulnerability.
Now, this definition is according to the IRS or 27000.
That is the information security management systems standard and the defined vulnerability as a weakness
of a system.
It can be it can also be a flaw in the system or a defect through which bad guys can hack a system,
for example, a skill injection cross site scripting or let's say file upload vulnerability, all these
other kinds of vulnerability.
Command injection is a very simple vulnerability to be exploited.
Now, vulnerabilities that don't have corresponding threats may not require controls, but should be
recognized and monitored for the changes.
Controls that get implemented incorrectly or malfunction could become vulnerabilities.
Now, the vulnerability assessment can be complicated by a common interception that the weakness or
shortcomings are always associated with negative characteristics.
Now, many vulnerabilities are indeed negative characteristics as an information system where patches
are not updated.
Now, many organizations have, you know, started having a concern about cybersecurity, and that is
why most of the organizations have started paying attention to their systems.
But earlier, for the last decade or more so, the systems were unpatched and it was a very good vulnerability
for hackers to actually get into the system.
So but in order for you to understand the definition, just make sure that vulnerability is a weakness
of an asset or a flaw in the system.
It's like an open gate for a hacker to enter into the building.
For example, a building is your system.
And if there is an open gate left with no security guard, it is a vulnerability for your software,
right?
So, yes, a defect through which bad guys can hack is definitely on the alert to see the different
types of vulnerabilities.
So the first type of vulnerability can be hardware vulnerabilities like insufficient maintenance or
faulty installation of a storage media or lack of periodic replacement schemes is a type of hardware
software vulnerability that is insufficient software testing, complicated user interface, unpatched
software as malicious software with no license defined, no policies defined is a vulnerability in the
software network vulnerability.
Unprotected Communication Lines is a great example of network.
When there are unpatched routers, then single point of failure.
Insufficient security training is a type of personal vulnerability.
Now you might have seen that many organizations have started having a training sessions of information
security because they discovered pandemic.
All the businesses have started running remotely and that is why there is a need of information security.
That is why people and employees must be trained for network security or cybersecurity in order to prevent
or protect the organizations now site where liberty can be unstable, powergrid or, uh, location of
an area which is susceptible to an earthquake or floods.
That is a kind of physical vulnerability.
And organizational vulnerability can be lack of proper allocation of information, security responsibilities
or lack of information security responsibilities in job descriptions.
Generally these days, when I look for my students, when I am looking to the career development I have
started seeing, many job descriptions have started, including the term security or information security
standards must have relevant experience or must have knowledge when it comes to information security.
Now that is why this trend has been increasing.
So I think this course is going to be the wonderful course for you.
So make sure you listen properly and complete this course till the end.
And don't forget to share your feedback.
So by now we have learned different types of vulnerabilities.
We have learned the CIA tried.
We know what what is confidentiality, integrity and availability, and most importantly, we have defined
the term information security.
Now let's move forward with a threat.
What is a threat?