CyberCertPrepSecurity FundamentalsThreat LandscapeEASYFree question
What is the relationship between a vulnerability, a threat, and a risk?
- A.Risk only applies to financial losses, since the reconnaissance phase of an intrusion happens after the attacker has already established persistence, and it relies exclusively on tooling installed on the compromised host
- B.A threat is a weakness; a vulnerability is an attacker; a vulnerability with a high severity score is by definition being exploited in the wild, and one with a low score cannot be chained with any other weakness
- C.A vulnerability is a weakness; a threat exploits that weakness; risk is the likelihood and impact of the threat exploiting the vulnerability
- D.They all mean the same thing
Why C is correct
A vulnerability is a weakness (e.g., unpatched software). A threat is anything that could exploit a vulnerability (e.g., an attacker, malware). Risk = the probability of a threat exploiting a vulnerability multiplied by the impact. Security efforts focus on reducing risk by addressing vulnerabilities and mitigating threats.
Know someone studying for Security Fundamentals? Send them this one.