Information Security Basics
When thinking about information security risk, which of the following is a vulnerability rather than a threat?
- AOffice PCs that have not had their operating system security updates applied
- BEmails with malware attached arriving from the internet
- CDamage to equipment from an earthquake or fire
Show answer and explanation
Answer: A. Office PCs that have not had their operating system security updates applied
A threat is an event or action that could cause harm, such as unauthorized access by an attacker, malware, natural disasters or operating mistakes. A vulnerability is a weakness that a threat can exploit, such as un-updated software, easily guessed passwords, misconfigurations or lax control of who enters a room. Risk combines the likelihood that a threat exploits a vulnerability to harm information assets with the size of that harm. Even when a threat exists, harm is unlikely if there is no vulnerability for it to exploit, and reducing vulnerabilities is a typical way to lower risk.
- A. Correct. Un-updated software is a weakness that attacks can exploit, so it is a vulnerability.
- B. Emails carrying malware are an external action that could cause harm, so they are a threat.
- C. Earthquakes and fires are threats from natural disasters (environmental threats).