Vulnerability

Name:

Date:

Class:

Quick Questions

Shade in the A or B circle for each question.

1. Which statement best describes a vulnerability?

A An action that steals data from an asset

B A weakness that a threat could use to harm an asset

2. A website has a login form that does not check what users type in. What is this?

A A software vulnerability

B An attack

3. True or false: a vulnerability is the same thing as an attack.

A False - a vulnerability is only a weakness

B True - they both mean someone is hacking

4. A student uses the same easy password for every account. Which type of vulnerability is this?

A A user vulnerability (a person)

B A hardware vulnerability

5. A school app uses a code library that has a known flaw. Which type of vulnerability is this?

A A user vulnerability

B A supply chain vulnerability

Match the Pairs

Draw a line connecting each item on the left to its match on the right.

Left column		Right column
1vulnerability = "unpatched app"		Avulnerability = "unverified download"
2vulnerability = "staff reuse passwords"		Battack = threat + vulnerability
3A vulnerability can be a weakness in the supply chain, such as software that came from an untrusted source		CA weakness in software that a threat could use to harm an asset
4A vulnerability is only a weakness. An attack happens when a threat uses it.		DA weakness in people or user habits that a threat could use to harm an asset
5A hacker stole data = vulnerability		EThis confuses an attack with a vulnerability. Stealing data is an attack. The vulnerability is the weakness that allowed it, such as a bug or weak password.
6vulnerability = only software bugs		FVulnerabilities are not only in software. They can also be in hardware, processes and people, such as staff falling for scams.

Definitions

vulnerability

Fill in the Blanks

Complete each line of code by filling in the missing parts.

_____________ = a weakness in a system

______ + vulnerability -> harm to asset

threat + vulnerability -> harm to _____

____ vulnerability = weak password choice

isAttack(vulnerability) = _____

Spot the Error

Shade in the letter of the line that contains an error.

Question 1

A asset ← "student database"

B weakness ← "old software"

C vulnerability ← weakness

D attack ← true

Question 2

A IF flaw is in the code THEN

B type ← "hardware"

C ELSE IF flaw is a person THEN

D type ← "user"

Question 3

A flaw ← "shared password"

B asset ← "staff email"

C type ← "hardware"

D PRINT type

Question 4

A library ← "free image tool"

B flaw ← "hidden bad code"

C source ← "third party"

D type ← "user"

Question 5

A vulnerability ← attack

B threat ← actor who uses it

C harm ← threat USES weakness

Answer Key

Vulnerability

Section A: Quick Questions

B — A weakness that a threat could use to harm an asset

A — A software vulnerability

A — False - a vulnerability is only a weakness

A — A user vulnerability (a person)

B — A supply chain vulnerability

Section B: Match the Pairs

vulnerability = "unpatched app" → A weakness in software that a threat could use to harm an asset

vulnerability = "staff reuse passwords" → A weakness in people or user habits that a threat could use to harm an asset

A vulnerability can be a weakness in the supply chain, such as software that came from an untrusted source → vulnerability = "unverified download"

A vulnerability is only a weakness. An attack happens when a threat uses it. → attack = threat + vulnerability

A hacker stole data = vulnerability → This confuses an attack with a vulnerability. Stealing data is an attack. The vulnerability is the weakness that allowed it, such as a bug or weak password.

vulnerability = only software bugs → Vulnerabilities are not only in software. They can also be in hardware, processes and people, such as staff falling for scams.

Section C: Definitions

vulnerability — A weakness in software, hardware, a process or a person that a threat could use to harm an asset. A vulnerability is only a weakness, not an attack.

Section D: Fill in the Blanks

vulnerability = a weakness in a system

threat + vulnerability -> harm to asset

user vulnerability = weak password choice

isAttack(vulnerability) = False

Section E: Spot the Error

D — A vulnerability is only a weakness. It is not an attack. No attack has happened until a threat uses the weakness, so attack should be false here.

B — A flaw in the code is a software vulnerability, so type should be "software". It is not a hardware vulnerability.

C — Sharing a password is a weakness in how a person behaves, so it is a user vulnerability. It is not a hardware vulnerability.

D — The weakness comes from a third-party library that the system depends on, so it is a supply chain vulnerability, not a user vulnerability.

A — A vulnerability is a weakness, not an attack. An attack happens when a threat uses the weakness, so line 1 should be vulnerability ← weakness.