Threats, vulnerabilities and risk

On Jordan's second shadowing afternoon, Keisha handed him a sticky note with three words: asset, threat, vulnerability. "Clients ask me if they are secure," she said. "That question has no answer. What I can answer is: what do you have that is worth protecting, who or what might harm it, and where are you weak? Put those together and you have risk, and risk is something we can actually manage." She asked him to come back in an hour with those three lists for Prairie Paws Veterinary Clinic.

This lesson defines the vocabulary that the rest of the course depends on. The exam expects you to tell a threat from a vulnerability, to recognize the kinds of people and events that threaten organizations, to understand how likelihood and impact combine into risk, and to know the four basic ways an organization can respond to a risk. CSCO-122 builds on this with vulnerability scanning and formal risk frameworks.

Assets

An asset is anything of value to the organization that could be harmed. Assets include data, such as patient records, client files and payment information; systems, such as servers, laptops, point-of-sale terminals and cloud accounts; people and their knowledge; physical things such as buildings and equipment; and less tangible things such as reputation and the trust of customers. Security starts with knowing what you have. You cannot protect a server you do not know exists, and you cannot judge the harm of losing a database if you do not know what is in it.

Jordan's asset list for Prairie Paws was longer than he expected: the practice-management application and its database of animal and owner records, 18 PCs across two locations, a reception kiosk, label printers, the clinic's email accounts, the payment terminal, the backup drive, the website and booking form, the Wi-Fi networks, and the veterinarians' own knowledge of their systems. Keisha added two he had missed: the clinic's online reviews, which a breach could damage, and the controlled-drug log, which regulators expect to be accurate.

Threats and threat actors

A threat is anything that could exploit a weakness and cause harm to an asset. Some threats are deliberate, some accidental and some natural. A threat actor is the person or group behind a deliberate threat. Thinking about who might attack, and why, helps defenders decide which threats are realistic for a given organization. A small veterinary clinic is unlikely to be targeted by a foreign intelligence service, but it is very likely to receive phishing emails from criminals who send millions of them.

Not every threat is a person. Hardware failure, power outages, fire, flood and severe weather are environmental threats. Human error is one of the most common threats of all: an employee who emails a file to the wrong address, deletes the wrong folder, or leaves a laptop on a bus. A good threat list includes all of these. Keisha told Jordan that, in her experience, more small-business incidents start with a mistake or an unpatched system than with a clever attacker.

Vulnerabilities

A vulnerability is a weakness that a threat could exploit. Vulnerabilities can be technical, such as software with a known flaw, a default password on a printer, a firewall rule that allows too much, or an unencrypted wireless network. They can be procedural, such as no process for removing accounts when staff leave or no verification when someone asks to change payment details. They can be physical, such as an unlocked server cupboard, and human, such as staff who have never been shown what phishing looks like.

Publicly known software vulnerabilities are given identifiers in the Common Vulnerabilities and Exposures system, so a flaw might be called CVE-2026 followed by a number. The Common Vulnerability Scoring System, CVSS, gives each one a severity score from 0 to 10. These shared names and scores let vendors, defenders and tools talk about the same flaw. A zero-day vulnerability is one that attackers know about before the vendor has released a fix, so defenders have had zero days to patch. CSCO-122 covers how to find vulnerabilities and read scan results.

An exploit is the method or code that takes advantage of a vulnerability. When a threat actor uses an exploit against a vulnerability in an asset, the result is a security incident. Defenders do not need to know how to write exploits; they need to know that vulnerabilities exist, how to find and fix them, and how to tell when one is being used.

Risk

Risk is the possibility of harm when a threat exploits a vulnerability in an asset. It is usually described by two factors: likelihood, how probable the event is, and impact, how bad the harm would be if it happened. A risk that is both likely and harmful needs attention first. A risk that is unlikely and minor may not be worth spending money on. If any of the three parts is missing, there is little risk: a vulnerable server that holds nothing of value and is not reachable by any threat is a low priority.

Many organizations rank risks on a simple grid. Each risk is given a likelihood score and an impact score, for example from 1 to 5, and the two are multiplied to give a risk score from 1 to 25. This is called qualitative or semi-quantitative analysis. It is quick and good for comparing risks, though the scores are judgments rather than measurements. Quantitative analysis puts money on the table instead, using measures such as the expected loss from one event and how often the event is expected to happen in a year.

Inherent risk, residual risk and the risk register

Risk analysts distinguish inherent risk, the risk before any controls are applied, from residual risk, the risk that remains afterward. Comparing the two shows how much a control is worth. Phishing at Prairie Paws might score 16 before controls; with mail filtering, training and multi-factor sign-in it might fall to 6. The difference is the value of those controls, and the remaining 6 is what the clinic must decide to accept or reduce further.

Most organizations keep a risk register, a simple table that lists each risk with its description, owner, likelihood, impact, score, chosen response, planned controls and review date. For Brightline's small clients, the register is often a single spreadsheet that Keisha reviews with the owner twice a year. It is not glamorous, but it turns security from a collection of worries into a list of decisions, each with a name beside it.

risks = {"Phishing, stolen mailbox": (4, 3), "Backup fails on restore": (2, 5),
         "Guest Wi-Fi reaches staff PCs": (3, 4), "Label printer stolen": (2, 1)}
for name, (l, i) in sorted(risks.items(), key=lambda kv: -kv[1][0] * kv[1][1]):
    s = l * i
    band = "high" if s >= 12 else "medium" if s >= 6 else "low"
    print(f"{s:>2}  {band:<6} {name}")

12  high   Phishing, stolen mailbox
12  high   Guest Wi-Fi reaches staff PCs
10  medium Backup fails on restore
 2  low    Label printer stolen

Responding to risk

Once a risk is understood, the organization decides what to do about it. There are four classic responses. Mitigation, also called reduction, means applying controls that lower the likelihood or the impact: training staff, adding multi-factor sign-in, patching software, separating networks. Transfer means shifting some of the financial impact to someone else, usually through cyber insurance or a contract with a supplier. Avoidance means stopping the activity that creates the risk, such as no longer storing card numbers at all. Acceptance means deciding to live with the risk, usually because it is small or because the cost of controls is higher than the expected harm.

Acceptance must be a deliberate decision by someone with the authority to make it, and it should be written down. Ignoring a risk is not the same as accepting it. Transfer does not remove the risk either: insurance may pay for recovery, but the clinic still has to tell its clients about a breach and live with the damage to its reputation. After controls are applied, some risk always remains; this is residual risk. The goal is to bring residual risk down to a level the organization is willing to accept, which is often called its risk appetite.

Threat intelligence

Threat intelligence is information about current threats that helps defenders make decisions: which vulnerabilities attackers are using now, which phishing themes are circulating, and which kinds of businesses are being targeted. Sources include national agencies, vendors' security blogs, industry sharing groups and the alerts built into security tools. For a small managed-services provider like Brightline, the most useful intelligence is often simple: an agency alert saying that a widely used remote-access product has a flaw being exploited, which tells Keisha to check every client that uses it today.

Keisha keeps a short list of sources and reads them daily. She also records what Brightline sees across its 40 clients, because a phishing campaign that hits one client this morning often hits three more by the afternoon. That local intelligence is shared in the team chat and used to update mail filters. CSCO-122 returns to threat intelligence as part of vulnerability management.