2.1 Threats, Vulnerabilities, and Risk

Threats, Vulnerabilities, and Risk

A threat is any potential danger that could exploit a weakness to cause harm (e.g., a hacker, malware, or natural disaster). A vulnerability is a weakness or gap in a system's defenses that could be exploited. Risk is the likelihood and impact of a threat exploiting a vulnerability. Formula: Risk = Threat × Vulnerability × Impact.

Types of Threats

Threats can be internal (employees, insiders misusing access) or external (outside attackers, hackers). They can also be intentional (deliberate attacks like hacking) or unintentional (human error, accidental data leaks). Natural threats include disasters like fires or floods that damage physical infrastructure and data availability.

Managing Risk

Organizations can't eliminate all risk, so they use risk management strategies: avoid (eliminate the activity), mitigate (reduce likelihood/impact via controls), transfer (shift risk, e.g., insurance), or accept (acknowledge and take no action) if the cost of prevention outweighs the potential loss.

Key terms

Threat

A potential danger (person, event, or condition) that could exploit a vulnerability to cause harm.

Vulnerability

A weakness or gap in a system's security that could be exploited by a threat.

Risk

The likelihood and potential impact of a threat exploiting a vulnerability; Risk = Threat × Vulnerability × Impact.

Risk management strategies

Avoid, mitigate, transfer, or accept — the four ways organizations respond to identified risks.

Internal vs. External threat

Internal threats come from within an organization (e.g., employees); external threats originate outside (e.g., hackers).

Try an AP-style question

Risk is best described as…

1. impact ÷ cost
2. vulnerability − control
3. threat + patch
4. likelihood × impact