Threat vs Vulnerability vs Risk Ecosystem

Threat, vulnerability and risk management practices are meant to achieve a minimum level of protection - this equates to a reduction in the total risk due to the protections offered by implemented controls. Think of this as a "risk management ecosystem" as it pertains to your overall security & compliance efforts. These ecosystem components have unique meanings that need to be understood to reasonably protect people, processes, technology and data.

Key Takeaways - Threat vs Vulnerability vs Risk

Threats are people or things that can cause damage. Vulnerabilities are weaknesses that threats exploit. Risks are the potential exposure to harm when threats meet vulnerabilities.
Controls are the safeguards designed to reduce risk. Procedures operationalize controls. Compensating controls provide equivalent protection when primary controls can't be fully implemented.
Think of this as a risk management ecosystem. These components interact in predictable ways that guide practical risk management activities.
Key risk concepts. Risk Appetite (what you're willing to accept), Risk Tolerance (how much you'll bear for a result), and Risk Thresholds (triggers for management action).
Words matter in compliance. Using the wrong terms can lead to miscommunication and poor risk decisions.

The Big Picture

The Risk Management Ecosystem

Understanding the context of how these components integrate can lead to more meaningful discussions and practical risk management activities. The diagram below is meant to show those interactions. It also helps show that compensating controls (e.g., POA&M items) are not bad, since compensating controls can help reasonably mitigate deficiencies.

You can click on the image below for a PDF version that helps visualize this risk management ecosystem, based on how these unique components interact.

Words Matter

Contextual Definitions

Please be a good person and avoid "word crimes" since words matter in compliance:

Threat

A person or thing likely to cause damage or danger (noun) or to indicate impending damage or danger (verb).

Vulnerability

A weakness in an information system, system security procedures, internal controls, or implementation that could be exploited or triggered by a threat source.

Risk

A situation where someone or something valued is exposed to danger, harm or loss (noun) or to expose someone or something valued to danger, harm or loss (verb).

Control

The safeguards or countermeasures prescribed for an information system or an organization to protect the confidentiality, integrity, and availability of the system and its information.

Comensating Control

The security controls employed in lieu of the recommended control(s) that provide equivalent or comparable protection for an information system or organization.

Procedure

A set of instructions used to describe a process or procedure that performs an explicit operation or explicit reaction to a given event. The design and implementation of a procedure must be reasonable and appropriate to address the control.

Reasonable

Appropriate or fair level of care. This forms the basis of the legal concepts of "due diligence" and "due care" that pertain to negligence.

Mitigate

To make less severe or painful or to cause to become less harsh or hostile.

Questions? Please contact us for clarification so that we can help you find the right solution for your cybersecurity and privacy compliance needs.