Threats, vulnerabilities, risk and risk management

Four words every security team uses

• Vulnerability: a weakness that an attacker could use to gain access or perform unauthorised actions. It might let them run code, read memory, install malware or steal, destroy or change data.
• Threat: anything that could harm systems or the organisation. Threats are natural (floods, storms, fire), unintentional (an employee opening the wrong file) or intentional (malware, spyware, a disgruntled insider).
• Risk: the probability that a particular threat will exploit a particular vulnerability, combined with how bad the result would be.
• Countermeasure: an action or tool that prevents or reduces a threat: antivirus, firewalls, patching, training, backups.

Viruses, worms and Trojans

Worm variants include email worms (malicious attachments), instant messaging worms (which abuse contact lists) and hybrids that spread like a worm but also modify files like a virus or carry a payload such as ransomware.

Other common threats

• Denial of service (DoS): makes a service unavailable to legitimate users, usually by buffer overflow (sending more data than a program can handle) or flooding (overwhelming it with traffic).
• Zero-day attack: exploits a vulnerability before the vendor has released a fix, so there is no patch yet.
• Identity theft: stealing a person’s login details or personal data to access accounts or commit fraud (financial, medical and other forms).

Risk management and the five principles

Risk management is the continuous process of finding, fixing and preventing security problems. Risk assessment is the part that decides how much protection each system and data set needs.

1. Assess risk and determine needs.
2. Establish a central management focus.
3. Implement appropriate policies and related controls.
4. Promote awareness.
5. Monitor and evaluate how effective the policies and controls are.

Risk analysis

Risk analysis identifies vulnerabilities and threats, estimates the possible damage, and shows where safeguards are worth putting. It lets an organisation rank its risks and tells management how much it is sensible to spend on each one, so money goes where it reduces the most risk.

A simple rating: score likelihood and impact from 1 to 5 and multiply them. A risk of 20 or more needs action now; a risk of 4 may simply be accepted and watched.

Real-world example: a small law firm's risk register

A ten-person law firm built its first risk register in a spreadsheet. One line read: asset client case files; threat ransomware; vulnerability the remote access gateway was two versions out of date and used passwords only; impact high, because files are confidential and needed daily; likelihood medium. That made the risk high.

The partners chose countermeasures in proportion: patch and then automatically update the gateway, add MFA, keep immutable cloud backups and run phishing awareness training. After these controls, the residual risk was rated low, and the partners formally accepted it. The register is now reviewed every quarter and after any incident, which turns risk management into an ongoing cycle rather than a one-off document.