Vulnerabilities and Exposure

Lesson plan

Level

Beginner

Time

About 60 minutes; the steps below add up to 62

Learners compare two identical broken locks, one on a public footpath and one in a walled garden, and find for themselves that weakness and reachability are separate questions, and that reachability can change. Those two questions then organise the lesson. Predictions precede how a stranger could find an office camera, which zero-day situation leaves defenders least prepared, and why an old breach matters to a work account; checks follow the matrix, the zero-day terms and the CVE example. The habit to build: ask “is it weak?” and “who can reach it?” separately, and never treat a score or a label as the organisation's risk.

Objectives

• Tell a weakness (a vulnerability) apart from reachability (exposure), and explain why the combination matters
• Explain how internet-facing devices become searchable
• Tell a zero-day vulnerability from a known, unpatched vulnerability and a zero-day exploit, and say where sources differ
• Say what a CVE ID, a CVSS score and an organisation's risk assessment each tell you
• Use breach services and vulnerability information responsibly

Before the lesson

• Open this page on your own screen and use “Open the lesson window” to open the lesson in a second window. Share only that second window.
• Learners need the Attack Chain lesson first.
• Do not demonstrate breach-search services with anyone's real details. If you show Shodan, search only for a product type, never for a named organisation, and do not connect to anything it finds.
• The lesson takes about 62 minutes. To teach it in two parts, stop after “Zero-day vulnerabilities”; the second part opens with “Looking up known vulnerabilities: the NVD”.
• In presentation mode every step is shown in turns: Next reveals one moment, part or answer at a time, and the instructor view names what is on screen and what comes next.

Steps

1. Introduction Opening

   On screen: the lesson’s title, module and number; Next adds its objectives and key terms, as the lesson page lists them; Next again begins the first step.

   Objectives on screen

   • Tell a weakness (a vulnerability) apart from reachability (exposure), and explain why the combination matters
   • Explain how internet-facing devices become searchable
   • Tell a zero-day vulnerability from a known, unpatched vulnerability and a zero-day exploit, and say where sources differ
   • Say what a CVE ID, a CVSS score and an organisation's risk assessment each tell you
   • Use breach services and vulnerability information responsibly

   Purpose: Learners compare two identical broken locks, one on a public footpath and one in a walled garden, and find for themselves that weakness and reachability are separate questions, and that reachability can change. Those two questions then organise the lesson. Predictions precede how a stranger could find an office camera, which zero-day situation leaves defenders least prepared, and why an old breach matters to a work account; checks follow the matrix, the zero-day terms and the CVE example. The habit to build: ask “is it weak?” and “who can reach it?” separately, and never treat a score or a label as the organisation's risk.

2. 1. Two broken locks Think 6 min

   Purpose: Find the two separate questions, weakness and reachability, from a familiar comparison, and see that reachability can change.

   Ask

   • Which broken lock is more urgent to fix?
   • How might the walled-garden lock still be used?

   Responses to expect

   • “Both equally” is a common first answer; ask who can walk up to each door today.
   • Answers: a family member, an open gate, a builder working in the garden.
   • On screen in turns: the opening question, its answer; then the question on how the walled-garden lock could still be used, and its answer.

   Discussion pause: Take a show of hands on the first question before revealing it.

   In the lesson window

   • Think it through: Which broken lock is the more urgent to fix?
   • Think it through: The walled-garden lock is less urgent. How might it still end up being used?

3. 2. Weakness and reachability are different questions Explain 8 min

   Purpose: Name vulnerability and exposure, place cases on the matrix, and link to the risk models.

   Ask

   • Where does the finance server go on the matrix?
   • Give an example of your own for each corner.

   Responses to expect

   • Some put it in the top corner because the flaw is serious. Ask who can reach it.
   • On screen in turns: the opening; then why separating the questions changes what you do; the exposure matrix; what the matrix does not show; the check question on the finance server, and its answer; how this connects to risk.

   Misconceptions to challenge

   • A learner may believe: “Only internet-facing systems matter.” Respond: Hidden weaknesses can become reachable through a stolen account, an insider or a change.

   Discussion pause: Before showing the matrix, ask the class to place the two houses from the opening on a two-by-two grid of weak and reachable.

   In the lesson window

   • Check your understanding: A server has a serious flaw, but it can only be reached from inside the finance office’s own network. Which part of the matrix is it in?

4. 3. Exposure: what can others see and reach? Predict 9 min

   Purpose: Show how internet-facing devices become searchable, and work through the forgotten camera.

   Ask

   • Could a stranger find the office camera without knowing its address?
   • At which step of the camera example did the weakness become an opportunity?

   Responses to expect

   • Many assume an address must be known. The four-step diagram answers it.
   • At the forwarding rule in step 2, when the camera became reachable.
   • Diagram: step through how a service becomes searchable; ask who acts at each stage before it appears.
   • On screen in turns: the opening question, its answer; then device search engines such as Shodan; how an exposed service becomes searchable, one stage at a time; the diagram’s stages one at a time; FOFA, and the lesson from these tools; the forgotten office camera, up to its exposure; discoverability and the weakness; the opportunity and the response; what the example shows.

   Misconceptions to challenge

   • A learner may believe: “If a device appears on Shodan, it has been hacked.” Respond: It shows exposure and what the device reveals, not that anyone has used it.

   In the lesson window

   • Think it through: A small office’s camera can be viewed from the internet. Could a stranger who has never heard of the office find it?

5. 4. Zero-day vulnerabilities Predict 11 min

   Purpose: Separate zero-day vulnerability, known unpatched vulnerability and zero-day exploit, and show where sources disagree.

   Ask

   • Which situation leaves defenders least prepared?
   • What is the code that uses an unknown flaw called?

   Responses to expect

   • Some pick “no fix yet”; ask whether the maker could at least warn people.
   • Learners often call the code the vulnerability.
   • Diagram: step through the life of a vulnerability and ask, at each stage, whether it is a zero-day in the broad usage and in the narrower one.
   • Another way to explain it: A shop’s broken lock nobody has noticed is a zero-day; once the owner knows but has not fixed it, it is known and unpatched; the replacement lock sitting in a box unfitted is a fix released but not applied.
   • On screen in turns: the opening question, its answer; then the broad definition of a zero-day; three terms that are easy to confuse, starting with zero-day vulnerability; known, unpatched vulnerability; zero-day exploit; why sources differ; the check question on the code that uses the flaw, and its answer; the life of a vulnerability, one stage at a time; the diagram’s stages one at a time; real vulnerabilities, and why fixes must be applied; the bank-door analogy.

   Misconceptions to challenge

   • A learner may believe: “Any vulnerability without a patch is a zero-day.” Respond: A released, uninstalled fix is never a zero-day; the disclosed-but-unfixed case is where sources differ.

   If the explanation does not land: Return to the lock: nobody knows it is broken (zero-day); the locksmith knows but has no part yet; the part has arrived but nobody has fitted it.

   To go further

   • Why might a vendor choose to disclose a flaw before a fix is ready?

   In the lesson window

   • Think it through: A flaw is found in a popular app. In which of these situations have defenders had the least chance to protect themselves?
   • Check your understanding: An attacker uses a piece of code that takes advantage of a flaw the vendor has never heard of. What is the code called?

6. 5. Looking up known vulnerabilities: the NVD Explain 8 min

   Purpose: Separate CVE (a name), CVSS (technical severity) and risk (the organisation's own priority), using the camera example.

   Ask

   • What does the CVE ID alone tell the office?
   • Why does a critical score not settle the camera's priority?

   Responses to expect

   • Many think the CVE ID says how serious it is. Point to the three-way list.
   • On screen in turns: the opening; then CVE, CVSS and risk, starting with CVE; CVSS; risk, and what the NVD adds; checking the camera against published vulnerabilities; reading the entry; assessing the risk and acting; the check question on what the CVE ID tells the office, and its answer.

   Misconceptions to challenge

   • A learner may believe: “The highest CVSS score is always the top priority.” Respond: Exposure, the asset and existing controls decide the risk.
   • A learner may believe: “A high CVSS score means it must be fixed first everywhere.” Respond: CVSS rates technical severity. Each organisation’s priority also depends on exposure, the asset and its controls.

   In the lesson window

   • Check your understanding: In the camera example, what does the CVE ID on its own tell the office?

7. 6. Breached data and exposed credentials Predict 5 min

   Purpose: Show why breached passwords matter beyond the breached site, and how to use breach services responsibly.

   Ask

   • Why might an old shopping-site breach matter to your work account?

   Responses to expect

   • Most reach password reuse quickly.
   • On screen in turns: the opening question, its answer; then breach-search services; why breached data matters, and responsible use.

   In the lesson window

   • Think it through: Your email address and an old password appear in a breach of a shopping site you used years ago. Why might that matter for your work account?

8. 7. Staying informed Explain 3 min

   Purpose: Point to sources for keeping up, and to reporting through the proper route.

   Ask

   • Which of the three sources would you check first after hearing of a new flaw in software you use?

   Responses to expect

   • The vendor's advisory or the NVD; news for awareness.
   • On screen in turns: the opening; then ways of keeping up; noticing, in an IT support role.

9. 8. Apply it in a new situation Apply 4 min

   Purpose: Set up independent application, ideally on a later day.

   Ask

   • Who will try these now, and who later in the week?

   Responses to expect

   • The heating controller tests the two questions together; the breach search tests responsible use.
   • On screen in turns: the opening question, its answer; then the question on searching for a colleague, and its answer.

   In the lesson window

   • Apply it: A school’s new heating controller has a web page that the supplier reaches over the internet for maintenance. Its default password has never been changed. Where is it on the matrix, and what comes first?
   • Apply it: A colleague offers to search a breach service for a manager’s personal email address, “to see what’s out there”. What is the right response?

10. 9. Check your understanding Check 5 min

    Purpose: Check the lesson against the approved revision-bank questions.

    Ask

    • Answer individually, then compare before revealing.

    Responses to expect

    • The exposure-reduction question is multiple-select.
    • On screen in turns: the opening; then the revision questions one at a time, each followed by its answer; where to practise next.

11. 10. What to remember Consolidate 3 min

    Purpose: Summarise the five points, the key terms and the misunderstandings.

    Ask

    • Without looking: what are the two questions, and which corner of the matrix comes first?

    Responses to expect

    • Is it weak; who can reach it. Weak and reachable.
    • On screen in turns: the opening; then the summary; the key terms; the common misunderstandings.

12. Lesson recap Closing

    On screen: the lesson’s objectives again; Next adds the closing question, which asks the class to explain each one in their own words without looking back. It says nothing about what anyone has learnt: use the answers to decide what to revisit.

    Points to listen for

    • Weak, and reachable: two questions, and the danger lies where both are yes.
    • Anything that answers the internet can be found by searching for it.
    • Unknown to the vendor is a zero-day; fixed but not installed is known and unpatched.
    • Name, severity and risk are three different things.
    • A reused password carries one breach into every other account that shares it.

Consolidation

• Weak, and reachable: two questions, and the danger lies where both are yes.
• Anything that answers the internet can be found by searching for it.
• Unknown to the vendor is a zero-day; fixed but not installed is known and unpatched.
• Name, severity and risk are three different things.
• A reused password carries one breach into every other account that shares it.