A threat is the real possibility that an actor or cause will exploit a vulnerability and harm a system or its data. Threats can target confidentiality, integrity, or availability, including in closed systems through physical access. section 11.1.2 section 11.6
Distinguish a threat from the related security concepts:
- A vulnerability is a potential weakness that can compromise system or data security. section 11.1.2
- An exploit is something that can be used to take advantage of a vulnerability. section 11.1.2
- A threat is the actor or real possibility of using an exploit against a vulnerability. section 11.1.2
- A mitigation technique is a measure implemented to protect against threats. section 11.1.2
From a house to a network
A window represents a vulnerability, a rock represents an exploit, and an intruder intending to break the window represents a threat. In a network, a malicious user can use tools against protocol vulnerabilities; DHCP Snooping is an example of mitigation. section 11.1.2
Threat analysis begins with knowing what can target networks, connected devices, and the people who use them. Common categories include denial-of-service, spoofing, reflection, man-in-the-middle, and reconnaissance attacks. section 11.2 section 11.6
