At a manufacturer, an internet-facing historian still runs a service the vendor no longer fixes, and nobody has attacked that service this week. What is that unfixed service?
Select an answer to reveal the explanation.
Short Explanation
A broken lock is still a weakness on a week when nobody tries the door. You call the unfixed historian service a vulnerability. The trap is naming a threat actor, an exploit, or a risk score when no attack and no rating were stated.
Full Explanation
A vulnerability is a weakness that could be used. A service the vendor no longer fixes is that weakness whether or not anyone attacked it this week. The actor who might use it, the method that would use it, and a numeric rating of exposure are separate ideas. "A vulnerability: the weakness in a service the vendor no longer provides fixes for". The unfixed service is the weakness itself, which remains even with no attack this week. "A threat: the actor or event that might try to abuse the unfixed historian service later". A threat is the actor or event that might use a weakness. The stem describes the service, not a crew or an attack that is underway. "An exploit: the method or code that would use the weakness against that historian service". An exploit is the method or code that uses a weakness. No such method is described; only the unfixed service is. "A risk score: the rated exposure of the historian as it might appear on a dashboard". A risk score is a rated exposure. The stem gives no score, and the service is not itself a number on a dashboard. Exam caveat: absence of an attack this week does not convert a weakness into safety, and it also does not turn the weakness into a threat or an exploit. Operational check: match the historian service to the vendor notice that fixes have ended, and record the weakness without requiring an attack log from this week.