Vulnerability
Definition
A weakness in an asset or in a control protecting that asset, which a threat could exploit to cause harm. Examples: an unpatched operating system, a server room without fire suppression, a database accessible without authentication, a process that lacks segregation of duties.
Related terms
- Threat
- A potential cause of an unwanted incident that could harm an asset. Threats may be natural (flood, fire), environmental (power failure), human...
- Asset inventory (asset register)
- A structured record listing every information asset in scope, together with its owner, custodian, physical or logical location, classification level, criticality rating,...
- Asset owner
- The person or role accountable for ensuring an asset is appropriately classified, protected, and reviewed. The owner is typically a business manager...
- Availability
- The property that systems and data are accessible to authorised users when needed. Protected by redundancy, backup, failover, and incident response capabilities....
- Classification tier
- A label assigned to an asset or data type indicating its sensitivity and the handling rules that apply. Common tiers are Public,...
- Confidentiality
- The property that information is not disclosed to unauthorised individuals, processes, or devices. Protected by access controls, encryption, and need-to-know policies. Breached...
- Information asset
- Anything that has value to the organisation by virtue of the information it contains or the information function it performs. Includes data,...
- Integrity
- The property that information is accurate, complete, and has not been modified without authorisation. Protected by cryptographic hashing, digital signatures, and change...
- Non-repudiation
- The property that a party cannot deny having performed an action. Provided by digital signatures, timestamped audit logs, and certified delivery receipts....
Explained in these topics
- The CIA Triad and Security FundamentalsA weakness in a system, process, or control that a threat could exploit. Vulnerabilities arise from software bugs, misconfiguration, procedural gaps, or physic...
- Risk Identification and Asset ClassificationA weakness in an asset or in a control protecting that asset, which a threat could exploit to cause harm. Examples: an unpatched operating system, a server roo...