Core security vocabulary for distinguishing threats, weaknesses, exploit paths, impacts, and confidentiality, integrity, and availability.
Security decisions improve when the underlying terms are kept distinct. A weakness, the action that uses it, and the resulting harm are separate parts of the same security scenario.
| Term | Meaning |
|---|---|
| Threat | A circumstance, actor, event, or condition that could cause harm |
| Vulnerability | A weakness that a threat could exploit |
| Exploit | A method or code path that takes advantage of a vulnerability |
| Risk | The potential for loss or harm, considering likelihood and impact |
| Control | A safeguard that prevents, detects, responds to, or reduces a risk |
The CIA triad describes three common security objectives:
1Weak administrator password → vulnerability
2Credential-stuffing attempt → exploit technique
3Unauthorized route modification → integrity impact
This analysis suggests different controls at different points: stronger authentication and password controls reduce the weakness; rate limits and monitoring can detect or limit the attempt; configuration management and audit logs help detect and recover from unauthorized changes.
| Observed harm | Most direct CIA objective |
|---|---|
| Unauthorized disclosure of packet captures | Confidentiality |
| Unauthorized modification of firewall rules | Integrity |
| A denial-of-service event makes a service unreachable | Availability |
Incidents can affect more than one objective. For example, ransomware may impair availability and integrity, while also creating confidentiality risk if data is taken. Naming the primary impact first keeps the response and communications clear.
Risk assessment also includes business context: asset value, exposure, plausible threats, existing controls, likelihood, impact, and risk acceptance. A technical finding is not automatically a business priority until those factors are considered.