Threats, vulnerabilities and risk

Three words are often mixed up. Keep them apart and the rest of security gets easier.

• A threat is something that could cause harm: a criminal, a careless mistake, a storm, a power cut, a flood.
• A vulnerability is a weakness that a threat could use: a door left unlocked, software that has not been updated, a password written on a note.
• Risk is the chance that a threat uses a weakness, multiplied by how bad the result would be.

An example. A river is a threat to a house (it can flood). Living at the bottom of the valley is the vulnerability. The risk is how likely a flood is, combined with how much damage it would do. Moving the furniture upstairs does not remove the river. It removes some of the impact.

Scoring risk. Teams usually give each risk two scores on a simple scale, such as 1 (low) to 5 (high):

• Likelihood: how likely is it to happen in the next year?
• Impact: how bad would it be if it did?

Then risk = likelihood × impact. Place each risk on a 5 × 5 grid (the risk matrix) and the top-right corner holds your most urgent problems. An invented example:

These scores are judgements on an ordinal scale (ordered, but not exact). A score of 12 is not "twice as real" as a 6. The grid is a way to sort and discuss, not a measurement of a physical quantity. Treat it as a good conversation starter and be honest about its limits.

What can you do about a risk? There are four standard answers:

• Reduce it: add a protection that lowers the likelihood, the impact, or both (updates, backups, locks, training).
• Accept it: decide it is small enough, or too costly to fix, and live with it knowingly.
• Transfer it: let someone else carry part of the cost, for example through insurance or a trusted service provider.
• Avoid it: stop doing the risky thing (do not collect data you do not need).

A protection you add is called a control. Every control has a cost (money, time, convenience), so a defender's real job is getting the most risk reduction for the budget.

Zero risk does not exist. Even a computer switched off in a locked room can be stolen or can fail. The goal is a risk that is understood and acceptable, not zero.