Module 73: Security Introduction
Vulnerabilities and the basics
🏠The everyday picture
A window latch that's been broken for months is a vulnerability. The burglar who notices it is the threat. The chance and cost of a break-in is the risk.
📘What it really is
- A vulnerability is a weakness that a threat could use: a bug, a missing check, a weak setting, an old library.
-
Public vulnerabilities get CVE numbers and severity scores (CVSS, 0 to 10). Tools like
npm audit, GitHub's Dependabot and container scanners check your dependencies against them (Module 78). -
The essential basics, which stop most real attacks:
- update software promptly (operating system, Node.js, packages, base images);
- strong authentication: unique passwords, a password manager, MFA everywhere it's offered (Module 74);
- least privilege: people and programs get only the access they need;
- secure configuration: no default passwords, no open databases, private buckets, HTTPS only;
- backups that are tested and kept away from the main system (Module 72);
- logging and monitoring so you notice problems (Module 72);
-
awareness: knowing what phishing looks like and checking before clicking or paying.
-
India's CERT-In (the national computer emergency response team) publishes advisories, and organisations must report certain incidents to it within six hours (Module 80).
🖱️Try it
Run npm audit on your CRM and sudo apt list --upgradable on your server, and fix what you can. Then score yourself
against the seven basics above for your CRM and your own accounts (email, GitHub, hosting): write yes, partly or no for each,
and fix one "no" today, starting with MFA on GitHub and your hosting account.
✅Quick check
What's the difference between a threat and a vulnerability?
Show the answer
A threat is something that could cause harm; a vulnerability is a weakness it could use.
Name three of the security basics that stop most attacks.
Show the answer
Any three: updates, strong authentication with MFA, least privilege, secure configuration, tested backups, monitoring, awareness.