Vulnerability
security flaw · security hole · weakness · vuln · vulnérabilité · faille
A weakness in software, hardware, a configuration or a procedure that an attacker can exploit to gain unauthorised access or cause an unauthorised effect.
In practice
A vulnerability can be a coding bug, a default password left in place, a service exposed for no reason or a payment approved without a second check. Public software flaws receive a CVE identifier and a CVSS severity score; CISA’s KEV catalogue lists those actually being exploited, which makes it an excellent way to prioritise. The riskiest period starts when a patch is published: attackers study it to rediscover the flaw and go after anyone slow to install it.
In May 2017, the WannaCry ransomware infected tens of thousands of machines in more than 150 countries by exploiting a Windows flaw (the SMB protocol, bulletin MS17-010). The patch had been available since 14 March 2017: the machines hit were the ones that had not yet installed it.
How to protect yourself
- Keep an up-to-date inventory of your software and devices, especially anything exposed to the internet.
- Patch with priority given to actively exploited flaws (the KEV catalogue, national CERT alerts).
- Remove default accounts and passwords and switch off services you do not need.
- Have your applications and exposure tested regularly (vulnerability scans, penetration tests).
