All right, a vulnerability.
Vulnerability is any weakness in an asset that can be exploited by threat agents.
So vulnerabilities can be default configurations, insecure patch management,
bugs in the operating system, unnecessary services enabled, etc.
Anything that is vulnerable to attack and
can lead to a breach or compromise of that asset can be considered a vulnerability.
Risk.
Risk refers to the potential loss or damage that can occur when a threat to an
asset exists and the presence of a vulnerability can be exploited.
It's what could happen and if it happens, how bad can it be?
There's lots and lots of emphasis on risk management in cybersecurity because you
can't get rid of all your risk, plain and simple.
You address the risk that causes you the most potential harm.
First, you spend your security dollars to address the higher risk levels.
Risk is measured through a variety of calculations and equations.
The example they're giving us here is the
risk equals asset plus threat plus vulnerability.