An enterprise security analyst is categorizing security audit findings and incident events into core cybersecurity governance definitions. Match each operational scenario on the left with its corresponding fundamental security concept on the right.
- An unpatched software bug in a border router's operating system that permits unauthorized privilege escalation.Vulnerability
- A specialized script executed by an adversary to take advantage of a known memory overflow flaw.Exploit
- A malicious actor currently attempting to perform man-in-the-middle packet interception on an unencrypted wireless link.Threat
- The potential financial loss and operational disruption resulting from a compromised customer database.Risk
Answer
1. Unpatched software bug matches Vulnerability. 2. Specialized script leveraging a flaw matches Exploit. 3. Malicious actor conducting packet interception matches Threat. 4. Potential financial loss and disruption matches Risk.
Each scenario maps directly to its core definition in information security governance: software flaws are vulnerabilities; malicious tools weaponizing flaws are exploits; active malicious actors/actions are threats; and the combined evaluation of potential impact and likelihood is risk.
Step-by-Step Solution
Key Concept
Fundamental Security Concepts: Threat, Vulnerability, Exploit, and Risk