Lesson 2.1: Assets, threats, vulnerabilities and risk

The four words security people use every day and how they fit together: an asset is what has value, a threat is what could harm it, a vulnerability is the weakness that lets it happen, and risk is how likely and how bad that would be. You score a small company's risk register (likelihood × impact), find the risks to deal with first, and choose a treatment for each: reduce, avoid, transfer or accept.

18 min

You will learn to

Define asset, threat, vulnerability and risk and tell them apart
Score a risk as likelihood × impact
Sort a risk register and pick the top risks
Choose a risk treatment: reduce, avoid, transfer, accept

Key terms

Asset: Anything of value to an organisation that needs protecting: data, systems, devices, people, reputation.
Threat: Something that could cause harm to an asset: a person, a group, an event or a mistake.
Vulnerability: A weakness a threat can use. Without a vulnerability, a threat has nothing to work with.
Risk: The chance that a threat uses a vulnerability, combined with how much damage that would do. Often scored as likelihood × impact.
Risk register: A table of an organisation's risks with their scores, owners and decisions.
Risk treatment: What you decide to do about a risk: reduce it (add controls), avoid it (stop the activity), transfer it (insurance, a provider) or accept it (knowingly live with it).

← Kernel, shell and terminal · All lessons · Introduction to the command line →