Overview Not all vulnerabilities are created equal. This lesson breaks down the major categories of vulnerabilities found in digital environments—software, configuration, network, human, and physical. Understanding these classifications helps prioritize remediation and anticipate where weaknesses are most likely to emerge.

1. Software Vulnerabilities

Flaws in code or logic that allow unintended behavior or access.

• Examples:
  • SQL injection
  • Buffer overflows
  • Insecure deserialization
  • Inadequate input validation
• Impact:
  • Data theft
  • Remote code execution
  • Authentication bypass
• Reference:
  • OWASP Top 10
  • CVE database (Common Vulnerabilities and Exposures)

2. Configuration Vulnerabilities

Secure software can be rendered unsafe by poor setup or defaults.

• Examples:
  • Default admin accounts left active
  • Open S3 buckets or public database endpoints
  • Weak file permissions
  • Missing security headers (e.g., CSP, HSTS)
• Impact:
  • Unauthorized access
  • Privilege escalation
  • Exposure of sensitive data
• Best Practice:
  • Use hardened baseline configurations
  • Automate configuration audits with tools like CIS-CAT or Lynis

3. Network Vulnerabilities

Weaknesses in protocols, services, or infrastructure that expose systems to remote attacks.

• Examples:
  • Open ports (e.g., Telnet, FTP)
  • Unencrypted traffic (lack of TLS)
  • Weak firewall rules
  • DNS cache poisoning
• Impact:
  • Man-in-the-middle attacks
  • Denial of service (DoS)
  • Lateral movement across systems
• Mitigation:
  • Use network scanners (e.g., Nmap, Nessus)
  • Enforce TLS 1.2+ and disable legacy protocols

4. Human Vulnerabilities

Behavioral or procedural weaknesses introduced by users or administrators.

• Examples:
  • Weak or reused passwords
  • Falling for phishing emails
  • Misuse of privileged access
  • Poor incident response practices
• Impact:
  • Credential theft
  • Malware installation
  • Insider threats
• Mitigation:
  • Enforce MFA
  • Conduct regular security awareness training
  • Apply least privilege principles

5. Physical Vulnerabilities

Security gaps in physical access or device handling.

• Examples:
  • Unlocked server rooms
  • Lost or stolen laptops
  • Insecure disposal of hardware
  • Lack of surveillance or access logs
• Impact:
  • Direct data theft
  • Tampering with infrastructure
  • Bypass of digital controls
• Mitigation:
  • Use biometric or badge access
  • Encrypt devices at rest
  • Implement chain-of-custody for hardware

Key Takeaways

• Vulnerabilities fall into five core categories: software, configuration, network, human, and physical
• Each category introduces unique risks and requires tailored mitigation strategies
• Classification helps prioritize fixes and align defenses with real-world attack vectors
• Security is not just technical—it’s procedural, behavioral, and physical