Page 161 - (ISC)² CISSP Certified Information Systems Security Professional Official Study Guide

unwanted outcome for an organization or for a specific asset is a
threat. Threats are any action or inaction that could cause damage,

destruction, alteration, loss, or disclosure of assets or that could block
access to or prevent maintenance of assets. Threats can be large or
small and result in large or small consequences. They can be
intentional or accidental. They can originate from people,
organizations, hardware, networks, structures, or nature. Threat
agents intentionally exploit vulnerabilities. Threat agents are usually
people, but they could also be programs, hardware, or systems. Threat

events are accidental and intentional exploitations of vulnerabilities.
They can also be natural or man-made. Threat events include fire,
earthquake, flood, system failure, human error (due to a lack of
training or ignorance), and power outage.

Vulnerability The weakness in an asset or the absence or the
weakness of a safeguard or countermeasure is a vulnerability.

In other words, a vulnerability is a flaw, loophole, oversight, error,
limitation, frailty, or susceptibility in the IT infrastructure or any other
aspect of an organization. If a vulnerability is exploited, loss or
damage to assets can occur.

Exposure Exposure is being susceptible to asset loss because of a
threat; there is the possibility that a vulnerability can or will be
exploited by a threat agent or event. Exposure doesn’t mean that a

realized threat (an event that results in loss) is actually occurring (the
exposure to a realized threat is called experienced exposure). It just
means that if there is a vulnerability and a threat that can exploit it,
there is the possibility that a threat event, or potential exposure, can
occur. Another way of thinking about exposure is to answer the
question “What is the worst that could happen?” You are not stating
that harm has occurred or that it will actually occur, only that there is

the potential for harm and how extensive or serious that harm might
be. The quantitative risk analysis value of exposure factor (EF) is
derived from this concept.

Risk Risk is the possibility or likelihood that a threat will exploit a
vulnerability to cause harm to an asset. It is an assessment of
probability, possibility, or chance. The more likely it is that a threat