Cyberstudy
PDF p.25 In progress

Vulnerability, Threat, and Risk

Open PDF at p.25 12 flashcards

Summary

PDF p.25

Security teams assess systems for potential attacks by evaluating vulnerabilities, threats, and risks. These elements help in identifying weaknesses, potential exploitations, and the overall hazard level.

In plain words

Supplementary — not from your PDF

A vulnerability is a weakness, a threat is someone or something that could use that weakness, and risk is how likely that is to happen multiplied by how bad it would be.

Detailed explanation

PDF p.25
  • Vulnerability
    • Definition: A weakness that can be accidentally triggered or intentionally exploited to cause a security breach.
    • Examples: Improperly configured hardware/software, delays in patching, poor network design, inadequate physical security, insecure passwords, software design flaws.
    • Severity Factors: Value of the asset and ease of exploitation.
  • Threat
    • Definition: The potential for someone or something to exploit a vulnerability and breach security.
    • Types: Intentional (malicious) or unintentional.
    • Components
      • Threat Actor/Agent: The person or thing posing the threat.
      • Threat Vector: The path or tool used by the threat actor.
  • Risk
    • Definition: The level of hazard posed by vulnerabilities and threats.
    • Calculation: Likelihood of exploitation by a threat actor and the impact of a successful exploit.

Important terms

taken from the text above
Severity Factors
Value of the asset and ease of exploitation.
Threat
The potential for someone or something to exploit a vulnerability and breach security.
Threat Actor/Agent
The person or thing posing the threat.
Threat Vector
The path or tool used by the threat actor.
Calculation
Likelihood of exploitation by a threat actor and the impact of a successful exploit.

Examples & real-world scenarios

Supplementary — not from your PDF
  • Vulnerability: a server that hasn't had security patches for a year.
  • Threat: a criminal group scanning the internet for unpatched servers (threat actor), using an exploit as the vector.
  • Risk: high, because the server holds customer data (big impact) and the flaw is widely known (high likelihood).

Scenario

Two identical unpatched servers: one is internal and holds test data, the other faces the internet and holds payroll. The vulnerability is the same, but the risk is very different because likelihood and impact differ.

Common mistakes

Supplementary — not from your PDF
  • Using threat and risk as if they mean the same thing. Risk combines likelihood and impact.
  • Forgetting that threats can be accidental, like an employee deleting the wrong folder.

Practical skills

Supplementary — not from your PDF
  • For a given weakness, name the threat actor, the vector and the likely impact.

What I should remember

Key Points PDF p.25
  • Vulnerability
    • Weakness: Can be triggered accidentally or exploited intentionally.
    • Examples: Misconfigured hardware/software, delayed patches, poor network design, insecure passwords.
    • Severity: Determined by asset value and ease of exploitation.
  • Threat
    • Potential Exploitation: Can be intentional or unintentional.
    • Threat Actor/Agent: The entity posing the threat.
    • Threat Vector: The method used to exploit the vulnerability.
  • Risk
    • Hazard Level: Based on vulnerabilities and threats.
    • Calculation: Likelihood and impact of exploitation.