Risk management is how an organization decides where to spend limited security resources. A risk is the likelihood that a threat will exploit a vulnerability, combined with the resulting impact on an asset. A threat is a potential cause of harm, such as a criminal group, an insider or a flood; the threat agent or actor is whoever or whatever carries it out. A vulnerability is a weakness, such as an unpatched server or an untrained employee. Exposure is being susceptible to loss, and a safeguard or countermeasure reduces risk. Keeping these terms straight is essential, because the exam uses them precisely.
Keep reading for free
Create a free StudyToCert account to read the rest of this lesson: 7 more sections, 7 key terms, a real-world example, an exam tip and self-check questions. Every lesson, lab and practice test is free with an account.