Threats, vulnerabilities and risk

Why these three words matter

People often mix up threat, vulnerability and risk. In a security job, mixing them leads to wrong decisions: you spend money on a scary-sounding problem that is unlikely, and miss a boring one that will really hurt. Each word has a clear meaning.

Asset

An asset is anything of value that you want to protect: customer data, a payment server, a laptop, your company's reputation, even an employee's time. You always start by listing assets, because you cannot protect what you do not know you have.

Vulnerability: the weakness

A vulnerability is a weakness that could be used to cause harm. Examples: an old version of software with a known bug, a password like "admin123", a server port open to the whole internet, or an employee who has never been told about phishing.

Publicly known software vulnerabilities get an ID called a CVE (Common Vulnerabilities and Exposures), for example CVE-2021-44228, the famous Log4j bug. Many also get a CVSS score from 0 to 10 that describes how severe the bug is in general.

Threat: who or what could cause harm

A threat is anything that could take advantage of a vulnerability. A threat actor is the person or group behind it. Threats are not only hackers: a careless employee, a flood in the server room or a power cut are threats too.

• Cyber criminals: want money, for example through ransomware or UPI fraud.
• Insiders: employees or contractors who misuse access, on purpose or by mistake.
• Hacktivists: attack to make a political point.
• Nation-state groups: well-funded teams that spy or disrupt for a government.
• Natural and accidental threats: fire, flood, a cable cut, a wrong configuration.

An exploit is the actual method or code that uses a vulnerability. If the vulnerability is an unlocked window, the exploit is climbing through it.

Risk: likelihood times impact

Risk is the chance that a threat uses a vulnerability, combined with how much damage it would do. A simple and widely used way to rate it is to score likelihood and impact from 1 (very low) to 5 (very high) and multiply.

likelihood = 4   # phishing emails arrive every week
impact = 5       # one stolen finance password could cost lakhs
risk = likelihood * impact
print("Risk score:", risk, "out of 25")

Bands differ between companies; the important thing is that everyone uses the same scale so risks can be compared.

Four ways to treat a risk

1. Reduce (mitigate): add a control, such as MFA or a patch.
2. Avoid: stop doing the risky thing, such as switching off an old unused server.
3. Transfer: share the cost with someone else, such as cyber insurance or an outsourced provider.
4. Accept: decide the risk is small enough and write down who accepted it and why.

Common mistakes

• Calling everything a "threat". "Our old VPN" is a vulnerability; "a ransomware gang" is a threat.
• Rating risk by fear instead of evidence. Ask how often it really happens and what it would really cost.
• Treating CVSS as risk. A 9.8 bug on a server nobody can reach may be lower risk for you than a 6.5 bug on your public website.
• Accepting a risk without writing down who accepted it. Unwritten acceptance is just ignoring it.