A vulnerability is a weakness; a threat is something that may exploit it
Weak passwords, unnecessary open services, outdated software, flat network design, plaintext protocols, default credentials, exposed management interfaces, and misconfigured firewall rules are vulnerabilities. An attacker, malware, accidental user action, or equipment failure can be a threat. Keeping the terms separate makes risk analysis clearer.
The control should reduce the specific weakness or its impact.
Weak or reused credentials turn legitimate login mechanisms into an easy entry point
Default passwords, shared administrator accounts, and reused credentials increase the chance that one compromise grants broad access. Strong unique authentication, multi-factor authentication where supported, and role-based least privilege reduce the risk. Network segmentation can limit what a compromised account/device can reach next.
Unencrypted management protocols expose sensitive data on the path
Telnet and traditional unprotected FTP are classic examples. Credentials and commands can be visible to anyone able to capture the traffic. SSH, SFTP, HTTPS, and other encrypted alternatives protect data in transit when configured correctly. Encryption does not fix weak authorization, but it prevents easy network eavesdropping.
Every reachable service increases the attack surface
A server that needs HTTPS does not automatically need SSH, FTP, SMB, database, and management ports reachable from every client. Disable unnecessary services and filter required services to the narrowest useful source/destination scope. Least privilege applies to network ports as well as user accounts.
Known software flaws can remain exploitable until systems are updated
Operating systems, routers, switches, access points, firewalls, and applications all receive security updates. Patch management reduces exposure to known vulnerabilities, but changes should still be tested and scheduled appropriately. A patched device can remain vulnerable through weak credentials or bad configuration.
Defense requires multiple controls rather than one checklist item.
A flat LAN can let one compromised device reach too much
If student, staff, server, IoT, and management devices all share one unrestricted network, compromise can spread or expose sensitive services. VLANs and Layer 3 policy can separate roles and limit allowed flows. Segmentation should be based on trust and communication requirements, not just arbitrary subnet sizes.
Weak wireless security exposes the local network before routing even begins
Open Wi-Fi or obsolete security modes can allow unauthorized association or easier interception. WPA2/WPA3 with strong authentication protects access and radio traffic, while guest isolation and VLAN design limit what connected devices can reach. Signal strength itself is not a security control.
A security device can create vulnerability when its policy is too broad
A firewall rule such as allow any any may make an application work while exposing far more services than intended. A trunk that carries unnecessary management VLANs, an ACL placed in the wrong direction, or a public management interface can create similar configuration risk.
Security review should compare the configured policy with the stated requirement.
Read the weakness before choosing the control
| Weakness | Direct control direction |
|---|---|
| Plaintext remote administration | Use encrypted management such as SSH |
| Guest access to internal servers | Segment and filter guest traffic |
| Default administrator password | Change credentials; use stronger authentication |
| Unused exposed service | Disable/filter it |
| Unpatched known flaw | Apply appropriate update/mitigation |
| Open Wi-Fi | Use appropriate wireless authentication/encryption |
Swipe horizontally to see the full table.