Analyzing Risk + Risk Identification

Threats

are any possible events that might have an adverse impact on the confidentiality, integrity, and/or availability of our information or information systems

Vulnerabilities

are weaknesses in our systems or controls that could be exploited by a threat

Risks

occur at the intersection of a vulnerability and a threat that might exploit that vulnerability. A threat without a corresponding vulnerability does not pose a ___, nor does a vulnerability without a corresponding threat

External risks

are those risks that originate from a source outside the organization

Internal risks

are those risks that originate from within the organization

Multiparty risks

are those that impact more than one organization

Legacy

systems

IP theft risks

occur when a company possesses trade secrets or other proprietary information that, if disclosed, could comprise the organization’s business advantage

Software compliance/licensing risks

occur when an organization licenses software from a vendor and intentionally or accidentally runs afoul of usage limitations that expose the customer to financial and legal risk