← Years 9–10 Digital Systems

Vulnerability

A weakness in software, hardware, a process or a person that a threat could use to harm an asset. A vulnerability is only a weakness, not an attack.

Part of: 9-10 Digital Technologies Vic Curric - Digital Systems and Security — Module 36, VCE Software Development - U4O2 - Cyber Security: secure software development practices — Module 12, VCE Data Analytics - U4O2 - Cyber Security: Data Security — Module 16, IGCSE Computer Science 0478 — 5.3 Cyber Security — Module 2, ACARA Digital Technologies Years 7–8 — Networks and Cyber Threats — Module 7, ACARA Digital Technologies Years 9–10 — Networked Systems and Access Control — Module 138, ACARA Digital Technologies Years 9–10 — Cyber Security Threats and Vulnerabilities — Module 8, QCE Digital Solutions Unit 4 — Complex Digital Data Exchange Problems and Solution Requirements — Module 22, WA Computer Science ATAR Year 11 — Cyber Security — Module 7

Understanding Vulnerability in Years 9–10 Digital Systems

What it does: An unverified download is a supply chain weakness. It might carry hidden harmful code, so it could be used to harm an asset. The attack needs a threat to act on the weakness. The vulnerability alone is not the attack. The missing check is a weakness in the software. It only becomes an attack when someone uses it. People can be weak points too. Poor password habits are a user vulnerability. The flaw is the vulnerability. The crafted message is the exploit or attack that uses it. The lack of training is the weakness. The phishing email is the threat that could use it.

Common mistakes: A vulnerability is only a weakness. It is not an attack. No attack has happened until a threat uses the weakness, so attack should be false here. A flaw in the code is a software vulnerability, so type should be "software". It is not a hardware vulnerability.

Class: _____________________  ·  Name: _____________________  ·  Date: _________

Free printable worksheet with full answer key — or add this module to a class and your students practise it interactively.

🖨 Print worksheet + answer key Add Vulnerability to a class →

This module's key terms are also in a printable crossword (Modules 25–40) and word search (Modules 13–40).

Take this worksheet further — free with Cloodit

Each concept is reinforced from every angle — learned, then applied, then tested.

Learning
Duo
Which statement best describes a vulnerability?
A weakness that a threat could use to harm an assetAn action that steals data from an asset
Matches
A hacker stole data = vulnerability
↓
This confuses an attack with a vulnerability. Stealing data is an attack. The vulnerability is the weakness that allowed it, such as a bug or weak password.
Applying
Meanings
Term
vulnerability
Meaning
A weakness in software, hardware, a process or a person that a threat could use to harm an asset. A vulnerability is only a weakness, not an attack.
Practice
asset ← "student records database"
Testing
Gaps
= a weakness in a system
Check Answer
Spots
3vulnerability ← weakness
4attack ← true

Cloodit turns curriculum-aligned coding content into journeys students work through one biome at a time.

The 'Giraffe' badge — High Perspective, one of Cloodit's 106 collectible badges
Students earn collectable badges

Over 100 of them, across seven natural biomes.

Study Buddy
Students build a real study resource

Turns their work into revision material ready for Flash Cards and Exam study.

Diamond Dash — one of Cloodit's live, competitive Sprint games
Students lock in with Sprints

Live, competitive practice for the start of the lesson or a teacher-led lesson finisher.

A Cloodit certificate of achievement, ready to personalise and print
Custom printable certificates

Honour your top performers, or encourage a student who's trying hard — ready to print in seconds.

Add to class →

Quick Questions

1. Which statement best describes a vulnerability?
A. An action that steals data from an asset
B. A weakness that a threat could use to harm an asset ✓
A vulnerability is a weakness. The action that uses it is an attack or exploit.
2. A website has a login form that does not check what users type in. What is this?
A. A software vulnerability ✓
B. An attack
The missing check is a weakness in the software. It only becomes an attack when someone uses it.
3. True or false: a vulnerability is the same thing as an attack.
A. False - a vulnerability is only a weakness ✓
B. True - they both mean someone is hacking
A vulnerability can exist for years without anyone attacking it. An attack is when someone tries to use it.
4. A student uses the same easy password for every account. Which type of vulnerability is this?
A. A user vulnerability (a person) ✓
B. A hardware vulnerability
People can be weak points too. Poor password habits are a user vulnerability.
5. A school app uses a code library that has a known flaw. Which type of vulnerability is this?
A. A user vulnerability
B. A supply chain vulnerability ✓
Weaknesses in code or tools made by others and used in your software are supply chain vulnerabilities.

Match the Pairs

vulnerability = "unpatched app" → A weakness in software that a threat could use to harm an asset
vulnerability = "staff reuse passwords" → A weakness in people or user habits that a threat could use to harm an asset
A vulnerability can be a weakness in the supply chain, such as software that came from an untrusted source → vulnerability = "unverified download"
A vulnerability is only a weakness. An attack happens when a threat uses it. → attack = threat + vulnerability
A hacker stole data = vulnerability → This confuses an attack with a vulnerability. Stealing data is an attack. The vulnerability is the weakness that allowed it, such as a bug or weak password.
vulnerability = only software bugs → Vulnerabilities are not only in software. They can also be in hardware, processes and people, such as staff falling for scams.

Key Term

vulnerability
A weakness in software, hardware, a process or a person that a threat could use to harm an asset. A vulnerability is only a weakness, not an attack.

Fill in the Blanks

1. vulnerability = a weakness in a system
Hint: Type the term for a weakness in software, hardware, a process or a person.
2. threat + vulnerability -> harm to asset
Hint: Type the word for something that could use a weakness to cause harm.
3. threat + vulnerability -> harm to asset
Hint: Type the word for the valuable thing that gets harmed.
4. user vulnerability = weak password choice
Hint: Type the word for the kind of vulnerability that comes from a person's habits.
5. isAttack(vulnerability) = False
Hint: Type the Boolean value that shows a weakness on its own is not an attack.

Spot the Error

Question 1
A asset ← "student database"
B weakness ← "old software"
C vulnerability ← weakness
D attack ← true
Line D — A vulnerability is only a weakness. It is not an attack. No attack has happened until a threat uses the weakness, so attack should be false here.
Question 2
A IF flaw is in the code THEN
B type ← "hardware"
C ELSE IF flaw is a person THEN
D type ← "user"
Line B — A flaw in the code is a software vulnerability, so type should be "software". It is not a hardware vulnerability.
Question 3
A flaw ← "shared password"
B asset ← "staff email"
C type ← "hardware"
D PRINT type
Line C — Sharing a password is a weakness in how a person behaves, so it is a user vulnerability. It is not a hardware vulnerability.
Question 4
A library ← "free image tool"
B flaw ← "hidden bad code"
C source ← "third party"
D type ← "user"
Line D — The weakness comes from a third-party library that the system depends on, so it is a supply chain vulnerability, not a user vulnerability.
Question 5
A vulnerability ← attack
B threat ← actor who uses it
C harm ← threat USES weakness
Line A — A vulnerability is a weakness, not an attack. An attack happens when a threat uses the weakness, so line 1 should be vulnerability ← weakness.

Student with a class code? Join your class →