SEC-2 Risk Management (N10-008) | Notes| Exam Prep
Review
Risk Management *** The process of identifying vulnerabilities and threats and deciding
which countermeasures to take. The main objective is to reduce the risk to a level that is deemed
acceptable by the organization's senior management.
Asset *** A resource that has value to the organization. Assets come in many
forms.*Information assets, such as files or databases that contain valuable
information.*Infrastructure assets or physical devices, such as routers, firewalls, bridges, and
servers.*Support services for the information services.
Threat *** Any potential danger to the confidentiality, integrity, or availability of information
or systems.
Vulnerability *** The possibility of an asset being exploited due to the absence or weakness of
an asset safeguard.
Threat Agent *** An entity that may find and exploit a vulnerability, causing a threat to an
asset.
Threat Vector *** The path or means that an attacker uses to compromise a system. Threat
vectors expose a system's vulnerabilities and are exploited by an attacker.
Review
Risk Management *** The process of identifying vulnerabilities and threats and deciding
which countermeasures to take. The main objective is to reduce the risk to a level that is deemed
acceptable by the organization's senior management.
Asset *** A resource that has value to the organization. Assets come in many
forms.*Information assets, such as files or databases that contain valuable
information.*Infrastructure assets or physical devices, such as routers, firewalls, bridges, and
servers.*Support services for the information services.
Threat *** Any potential danger to the confidentiality, integrity, or availability of information
or systems.
Vulnerability *** The possibility of an asset being exploited due to the absence or weakness of
an asset safeguard.
Threat Agent *** An entity that may find and exploit a vulnerability, causing a threat to an
asset.
Threat Vector *** The path or means that an attacker uses to compromise a system. Threat
vectors expose a system's vulnerabilities and are exploited by an attacker.
