It Security Vulnerability vs Threat vs Risk: What Are the Differences?

In today’s world, data and protecting that data are critical considerations for businesses. Customers want to ensure that their information is secure with you, and if you can’t keep it safe, you will lose their business. Many clients with sensitive information actually demand that you have a rigid data security infrastructure in place before doing business with you.

With that backdrop, how confident are you when it comes to your organization’s IT security?

In order to have a strong handle on data security issues that may potentially impact your business, it is imperative to understand the relationships of three components:

• Threat
• Vulnerability
• Risk

Though these technical terms are used interchangeably, they are distinct terms with different meanings and implications. Let’s take a look.

(This article is part of our Security & Compliance Guide. Use the right-hand menu to navigate.)

IT security vulnerability vs threat vs risk

David Cramer, VP and GM of Security Operations at BMC Software, explains:

What is a threat?

A threat refers to a new or newly discovered incident that has the potential to harm a system or your company overall. There are three main types of threats:

• Natural threats, such as floods, hurricanes, or tornadoes
• Unintentional threats, like an employee mistakenly accessing the wrong information
• Intentional threats, such as spyware, malware, adware companies, or the actions of a disgruntled employee

Worms and viruses are categorized as threats because they could cause harm to your organization through exposure to an automated attack, as opposed to one perpetrated by humans. Most recently, on May 12, 2017, the WannaCry Ransomware Attack began bombarding computers and networks across the globe and has since been described as the biggest attack of its kind. Cyber criminals are constantly coming up with creative new ways to compromise your data, as seen in the 2017 Internet Security Threat Report.

These threats may be uncontrollable and often difficult or impossible to identify in advance. Still, certain measures help you assess threats regularly, so you can be better prepared when a situation does happen. Here are some ways to do so:

• Ensure your team members are staying informed of current trends in cybersecurity so they can quickly identify new threats. They should subscribe to blogs (like Wired) and podcasts (like Techgenix Extreme IT) that cover these issues, and join professional associations so they can benefit from breaking news feeds, conferences, and webinars.
• Perform regular threat assessments to determine the best approaches to protecting a system against a specific threat, along with assessing different types of threats.
• Conduct penetration testing by modeling real-world threats in order to discover vulnerabilities.