ISC2 Certified in Cybersecurity (CC)Security PrinciplesMedium
During a routine security audit, an organization discovers an unpatched server running an outdated operating system directly exposed to the internet. This server hosts non-critical but publicly accessible information. What does the unpatched server represent in the context of risk management?
- AVulnerability
- BThreat
- CImpact
- DLikelihood
Show answer & explanationAnswer & explanation
Correct answer: A. Vulnerability
An unpatched server with an outdated operating system is a weakness that could be exploited, which directly defines a vulnerability.
Why the other options are wrong
- B. A threat is a potential cause of an unwanted incident, like a malicious actor or a natural disaster.
- C. Impact is the result or damage caused by a security event.
- D. Likelihood is the probability that a threat will exploit a vulnerability.
Vulnerability
A weakness or flaw in a system, design, or implementation that can be exploited by a threat.
- Can be in software, hardware, or human processes.
- Often exploited by threats to cause harm.
- Patching and secure configurations mitigate vulnerabilities.
Memory trick: A THREAT exploits a VULNERABILITY, causing an IMPACT. Think of a storm (threat) hitting a weak roof (vulnerability) and causing water damage (impact).