Assets, Threats, Risks & Vulnerabilities

Table of Contents

1. Understanding the Four Core Concepts
2. How They Connect
3. Assets — What We Protect
4. Threats — What We Protect Against
5. Risks — The Potential for Loss
6. Vulnerabilities — The Weaknesses
7. The Complete Risk Equation
8. Risk Management Process
9. Risk Assessment Methodologies
10. Real-World Scenario Walkthroughs
11. Common Mistakes in Risk Thinking

Understanding the Four Core Concepts

In cyber security, four terms form the foundation of risk analysis. Understanding these is essential before you can implement any security controls.

The Four Concepts at a Glance

Think of It Like a House

Another Analogy: Your Health

How They Connect

The Security Formula

The relationship is simple but powerful:

A THREAT exploits a VULNERABILITY to damage an ASSET
                       ↓
                    This is RISK

The Mathematical View

Risk = Likelihood (Threat × Vulnerability) × Impact (Asset Value)

Visual Relationship

┌──────────────────────────────────────────────────────────────┐
│                          RISK                                 │
│  ┌─────────────┐    ┌──────────────┐    ┌────────────────┐  │
│  │    ASSET    │    │   THREAT     │    │ VULNERABILITY  │  │
│  │  (Value)    │ ◄─ │  (Danger)    │ ◄─ │  (Weakness)    │  │
│  │             │    │              │    │                │  │
│  │- Customer   │    │- Hacker      │    │- Weak password │  │
│  │  database   │    │- Malware     │    │- Unpatched SW  │  │
│  │- Bank acct  │    │- Ransomware  │    │- Open port     │  │
│  │- Laptop     │    │- Insider     │    │- No firewall   │  │
│  └─────────────┘    └──────────────┘    └────────────────┘  │
└──────────────────────────────────────────────────────────────┘

In Simple Terms

A Threat (hacker) uses a Vulnerability (weak password) to damage an Asset (your bank account), creating Risk (potential financial loss).

The Boat Leak Analogy

• Asset = Your boat (valuable, keeps you afloat)
• Threat = Water trying to get in
• Vulnerability = A hole in the boat
• Risk = The chance that the boat sinks
• Control = Fixing the hole, using a pump

1. Assets — What We Protect

What is an Asset?

An asset is anything of value that needs to be protected. In cyber security, assets can be tangible (physical) or intangible (non-physical).

Complete Asset Categories

Asset Classification Levels

Assets are classified by how much damage would occur if compromised:

Asset Inventory — Where It All Starts

Before you can protect assets, you need to know what you have:

Good Asset Inventory Includes:
├── Asset name & description
├── Owner (who is responsible)
├── Location (where is it stored)
├── Classification (how sensitive)
├── Value (monetary or otherwise)
└── Dependencies (what relies on it)

Asset Management Questions

Ask yourself these 4 questions for every asset:

1. What assets do I have? — Create an inventory
2. How valuable is each asset? — Assign a value/priority
3. Who owns each asset? — Assign responsibility
4. What would happen if it was lost or compromised? — Understand the impact

Example: Small Business Asset Inventory

2. Threats — What We Protect Against

What is a Threat?

A threat is any potential danger that could exploit a vulnerability and cause harm to an asset.

Threat Categories

Detailed Threat Actor Profiles

Common Threat Sources (Detailed)

Threat Intelligence

Threat Intelligence is information about current and potential threats that helps organizations prepare:

3. Risks — The Potential for Loss

What is Risk?

Risk is the potential for loss, damage, or destruction of an asset due to a threat exploiting a vulnerability.

The Risk Equation

RISK = LIKELIHOOD × IMPACT

Where:
- Likelihood = Probability of the threat exploiting the vulnerability
- Impact = The damage caused if it happens

Risk Scoring

Risk Assessment Matrix

Risk Assessment Examples

The 4 Risk Management Strategies

Visual: Risk Management Decision Tree

Is the risk acceptable?
├── YES → Accept the risk (monitor periodically)
└── NO →
    ├── Can we avoid it? → Remove the risky activity
    ├── Can we mitigate it? → Implement controls
    ├── Can we transfer it? → Buy insurance, outsource
    └── Otherwise → Must accept residual risk

4. Vulnerabilities — The Weaknesses

What is a Vulnerability?

A vulnerability is a weakness in a system, process, or control that can be exploited by a threat to cause harm.

Categories of Vulnerabilities

Common Vulnerabilities and Their Solutions

The Vulnerability Lifecycle

1. INTRODUCTION → 2. DISCOVERY → 3. DISCLOSURE → 4. PATCH RELEASE → 5. PATCH APPLIED
     │                 │               │               │                 │
     ▼                 ▼               ▼               ▼                 ▼
  Bug is           Hacker or       Discoverer     Vendor creates     System admin
  introduced       researcher      informs        and releases       applies the
  in code          finds the bug   the vendor     a security fix     update

Vulnerability Windows

There are three critical time windows for every vulnerability:

Window 1: [CODE WRITTEN] ────────────→ [PATCH RELEASED]
          (Bug exists, no one knows)     (Fix available)

Window 2: [PATCH RELEASED] ────────────→ [PATCH APPLIED]
          (Fix available, but not installed yet)

Window 3: [VULNERABILITY DISCOVERED] ──→ [PATCH RELEASED]
          (Known by attackers, NO FIX YET — THIS IS ZERO-DAY!)

Zero-Day Vulnerabilities (Deep Dive)

Famous Zero-Day Example:

Stuxnet (2010) used FOUR zero-day vulnerabilities to attack Iranian nuclear centrifuges — the most sophisticated cyber attack at the time.

The Complete Risk Equation

Putting It All Together

RISK = (Threat × Vulnerability × Asset Value) — Controls

Where:
- Threat = Capability + Intent of the attacker
- Vulnerability = Severity + Exploitability of the weakness
- Asset Value = Importance + Sensitivity of the asset
- Controls = Effectiveness of existing security measures

Example Calculation

Risk Management Process

The 6-Step Risk Management Framework

Step 1: CONTEXT ESTABLISHMENT
        └── Define scope, objectives, risk appetite
                ↓
Step 2: RISK IDENTIFICATION
        └── Identify assets, threats, vulnerabilities
                ↓
Step 3: RISK ANALYSIS
        └── Determine likelihood and impact
                ↓
Step 4: RISK EVALUATION
        └── Compare against risk criteria, prioritize
                ↓
Step 5: RISK TREATMENT
        └── Select controls (Avoid/Mitigate/Transfer/Accept)
                ↓
Step 6: MONITOR & REVIEW
        └── Continuous monitoring, reassessment
                ↓
        ← (Back to Step 1 — it's a cycle!)

Real-World Risk Assessment Table

Risk Assessment Methodologies

1. Qualitative Assessment

Based on judgment, categories (Low/Medium/High). Most common.

2. Quantitative Assessment

Based on numbers, monetary values, percentages.

3. Hybrid Approach

Combines qualitative and quantitative — most organizations use this.

Real-World Scenario Walkthroughs

Scenario 1: Online Banking (Personal)

ASSET: Your bank account (contains $10,000)
  ↓
THREAT: Hackers trying to steal money
        - Automated bots scanning for weak passwords
        - Phishing emails targeting bank customers
        - Credential stuffing from other breaches
  ↓
VULNERABILITY: You use "password123" as your password
        - Also reusing this password on other sites
        - No MFA enabled
        - Your email (used for password reset) has same password
  ↓
RISK ASSESSMENT:
        Likelihood: Very High (4/4)
        Impact: Severe (4/4)
        Risk Score: 16/16 → CRITICAL
  ↓
CONTROLS IMPLEMENTED:
        - Changed to strong password (18 chars, random)
        - Enabled MFA via authenticator app
        - Used unique password for bank only
        - Enabled transaction alerts
  ↓
RESULT: Risk reduced from CRITICAL to LOW

Scenario 2: Small Business (Complete)

CONTEXT: Small online store with 1000 customer records

    ASSETS:
    ├── Customer Database (1000 records with names, emails, purchase history)
    ├── E-commerce Website (company's main source of revenue)
    ├── Employee Laptops (2 laptops, 1 shared desktop)
    └── Company Bank Account (for payments)

    IDENTIFIED THREATS:
    ├── Ransomware attack (via email phishing)
    ├── Website hacking (SQL injection)
    ├── Employee error (accidentally deleting data)
    └── Physical theft (laptop stolen)

    VULNERABILITIES FOUND:
    ├── No regular backups (last backup: 6 months ago)
    ├── Outdated antivirus on all computers
    ├── Website has no Web Application Firewall
    ├── Employees never received security training
    └── No access controls — everyone has admin rights

    RISK PRIORITIZATION:
    ┌─────────────────────────────────────────────────────┐
    │ 1. CRITICAL: Ransomware attack                      │
    │    → No backups, outdated AV, no training           │
    │    → Could lose ALL customer data + business income │
    ├─────────────────────────────────────────────────────┤
    │ 2. HIGH: Website hack                                │
    │    → No WAF, old plugins                            │
    │    → Could expose customer data                     │
    ├─────────────────────────────────────────────────────┤
    │ 3. MEDIUM: Laptop theft                             │
    │    → No encryption on devices                       │
    ├─────────────────────────────────────────────────────┤
    │ 4. LOW: Accidental deletion                          │
    │    → Some backups exist, but outdated               │
    └─────────────────────────────────────────────────────┘

    CONTROLS IMPLEMENTED (in priority order):
    Week 1: Set up daily automated backups (3-2-1 rule)
    Week 2: Updated antivirus on all computers
    Week 3: Installed WAF on website
    Week 4: Conducted security awareness training
    Week 5: Implemented access controls (no more shared admin)

    RESULT: Overall risk reduced from CRITICAL to MEDIUM

Scenario 3: Hospital (Healthcare)

ASSET: Patient medical records (PII + health data)
THREAT: Ransomware, data breach, insider threat
VULNERABILITY: Outdated medical devices, untrained staff
RISK: CRITICAL — patient safety at risk, HIPAA penalties

Why it's different from other scenarios:
- Lives are at stake (not just money)
- Strict regulatory requirements (HIPAA)
- Legacy systems that can't be easily updated
- 24/7 availability required for emergency care

Common Mistakes in Risk Thinking

Mistake 1: "It won't happen to me"

Reality: Automated attacks target everyone indiscriminately.

Mistake 2: Focusing only on external threats

Reality: Insider threats (intentional or accidental) are equally dangerous.

Mistake 3: Ignoring low-probability, high-impact risks

Reality: These are the risks that can destroy an organization (like a data center fire).

Mistake 4: Treating risk assessment as a one-time event

Reality: Threats and vulnerabilities change constantly — risk must be continuously reassessed.

Mistake 5: Assuming compliance = security

Reality: You can be fully compliant and still be insecure. Compliance is minimum baseline.

Mistake 6: Overlooking third-party risk

Reality: Your vendors' security becomes your security (SolarWinds, Target breaches).