Definition of Risk

There are different terms for risk in different fields. The following are the primary for security:

Risk itself is the function of threats exploiting vulnerabilities which results in damage or loss.

Vulnerability #

Vulnerability defines a known weakness of an asset. It can be mutable and ephemeral. It can be reduced by applying the principle of least privilege, network segmentation and similar practices. Often reduce is necessary but insufficient.

Threat #

A threat defines anything that can exploit a vulnerability. Often it is the most important risk component in intelligence-driven response. It can be described as the overlap of capability, intent, and opportunity.

• Intent: The intent of adversaries is often either profit or the desire to cause harm to an organization. It’s immutable and driven by the industry you are in. There is nothing that can be done to influence intent.

• Opportunity: It’s about timing and knowledge of target spaces. The increasing technology footprint of organizations can also lead to more opportunities. Specially when it contains vulnerability.

• Capability: A adversary need to have the capability to successfully achieve their goals and leverage opportunity. Capability is the ability of adversaries to successfully achieve their intended goals and leverage opportunity. It’s influenced by the skills and resources of the adversaries.

Each industry has a different threat landscape and each organization in each industry has a different risk profile, even to the same adversary