Class!  

  Below are various concepts defined that are used in assessing a threat, which should be done prior to an attack. This is called risk assessment and defines the asset, any vulnerabilities it has, any threats that might exist that might exploit the existing vulnerabilities, and the impact of the successful exploit.

 

The Assets

 

An asset could be anything that is part of the organizational resources which include data, service, and equipment. Data can be classified in terms of unclassified, restricted, confidential, secret, top secret, and sensitive but unclassified (SBU). Data may likewise be classified in terms of public, sensitive, private, and confidential. Regardless of different ways to classify data, there are factors and roles that are important. These factors include value, age, useful life, and personal association with the data. For the roles, there are three types of roles such as custodian, owner, and user.

 

Vulnerability

 

Vulnerability remain security weakness of any system, resource, or assets. It is a flaw of the system that can be exploited by a threat. For example, system vulnerabilities can be classified as security plan flaws, project errors, procedure defects, software liabilities, misconfigurations, hostile code, and human factors.

 

Threat

 

A threat refers to a probable danger to assets. For example, Trojan horse viruses, denial of service attacks, and social engineering are examples of common network threats.

 

Risk

 

In simplest term, risk refer to probability or threat of injury, harm, or any other negative incidences that may have caused by vulnerability (weakness).

 

Exploit

 

An exploit is an attack performed against a vulnerability.

 

Countermeasures

 

It is a protection that help to mitigate the potential risk. The security controls may fall into three categories such as administrative controls (security training, background checks, and auditing), technical controls (access control lists with layer 3 devices, virtual private networking), and physical controls (fire control systems and security guards).

 

So, what are some reasons for having a firm security policy in place?