Threat vs Vulnerability vs Risk

Threat vs Vulnerability vs Risk

Threat, vulnerability and risk management practices are meant to achieve a minimum level of protection - this equates to a reduction in the total risk due to the protections offered by implemented controls. Think of this as a "risk management ecosystem" as it pertains to your overall security & compliance efforts. These ecosystem components have unique meanings that need to be understood to reasonably protect people, processes, technology and data.

Risk Management Ecosystem

Understanding the context of how these components integrate can lead to more meaningful discussions and practical risk management activities. The diagram below is meant to show those interactions. It also helps show that compensating controls (e.g., POA&M items) are not bad, since compensating controls can help reasonably mitigate deficiencies.

You can click on the image below for a PDF version that helps visualize this risk management ecosystem, based on how these unique components interact.

Contextual Definitions

Please be a good person and avoid "word crimes" since words matter in compliance:

• Threat. A person or thing likely to cause damage or danger (noun) or to indicate impending damage or danger (verb). 
• Risk. A situation where someone or something valued is exposed to danger, harm or loss (noun) or to expose someone or something valued to danger, harm or loss (verb).
• Vulnerability. A weakness in an information system, system security procedures, internal controls, or implementation that could be exploited or triggered by a threat source.
• Control. The safeguards or countermeasures prescribed for an information system or an organization to protect the confidentiality, integrity, and availability of the system and its information. 
• Compensating Control. The security controls employed in lieu of the recommended control(s) that provide equivalent or comparable protection for an information system or organization.
• Procedure. A set of instructions used to describe a process or procedure that performs an explicit operation or explicit reaction to a given event. The design and implementation of a procedure must be reasonable and appropriate to address the control.
• Reasonable. Appropriate or fair level of care. This forms the basis of the legal concepts of "due diligence" and "due care" that pertain to negligence. 
• Mitigate. To make less severe or painful or to cause to become less harsh or hostile.