Difference Between Threat, Vulnerability and Risk
Difference Between Threat, Vulnerability and Risk
Penetration testing are tools that deals with threats, vulnerabilities, risks, and exploits. While many people in the field of information security, internet and computer security throw around these terms interchangeably, usually confusing threats with risk, or vulnerability with exploits. Each one of these terms has a distinct meaning, and these terms should be applied carefully.
What is a Threat?
A threat is an agent that may want to or definitely can result in harm to the target organization. Threats include organized crime, spyware, malware, adware companies, and disgruntled internal employees who start attacking their employer. Worms and viruses also characterize a threat as they could possibly cause harm in your organization even without a human directing them to do so by infecting machines and causing damage automatically. Threats are usually referred to as “attackers” or “bad guys”.
What is a Vulnerability?
Vulnerability is some flaw in our environment that a malicious attacker could use to cause damage in your organization. Vulnerabilities could exist in numerous areas in our environments, including our system design, business operations, installed softwares, and network configurations.
What is a Risk?
Risk is where threat and vulnerability overlap. That is, we get a risk when our systems have a vulnerability that a given threat can attack.
What is an Exploit?
An exploit is the way or tool by which an attacker uses a vulnerability to cause damage to the target system. The exploit could be a package of code which creates packets that overflow a buffer in software running on the target, which is also known as buffer overflows. Alternatively, the exploit could be a social engineering scheme whereby the bad guy talks a user, preferably an employee into revealing sensitive information, such as a password, over the phone.
Your job as a Penetration Tester
If we want to be a successful security professional, we have to work hard to minimize this risk by minimizing vulnerabilities and blocking threats. This is what penetration testing is all about. We have to model the activities of real-world threats to discover vulnerabilities. Then, through controlled exploitation, we attempt to determine the business risk connected with these flaws ad vulnerabilities. We then recommend and encourage suitable defenses. These recommendations must benefit our target organization. If we do this properly, then the security and protection of our target organization will greatly improve.
THIS IS THE REASON YOU NEED THIS
