A risk register's Threat column lists four entries: an unpatched VPN appliance, a ransomware crew, no MFA on administrator accounts, and severe storms. A reviewer says two entries belong in a Vulnerability column instead. Which two?
Select an answer to reveal the explanation.
Short Explanation
Here's an easy way to keep them straight: a threat is the burglar or the storm, and a vulnerability is the unlocked window. The burglar and the storm exist whether you do anything or not; the unlocked window is yours to fix. Missing MFA and an unpatched VPN box are your unlocked windows.
Full Explanation
A threat is a potential cause of harm, such as a person, group or event that could exploit a weakness. A vulnerability is a weakness in a system, process or control that a threat could exploit. Risk exists where a threat and a vulnerability meet, which is why registers keep them in separate fields. The unpatched VPN appliance is a weakness in the organization's own infrastructure, and the absence of multifactor authentication on administrator accounts is a gap in access control; both can be fixed by the organization, which marks them as vulnerabilities. Pairing the ransomware crew with the storms lists the two actual threats, an adversarial one and an environmental one, neither of which the organization can patch away. Pairing the ransomware crew with the VPN appliance mixes a threat with a vulnerability. Pairing the storms with the missing MFA makes the same mistake in the other direction. Exam caveat: a threat can be natural, accidental or adversarial, so absence of intent does not make something a vulnerability. Operational check: rewrite each register entry as a threat exploiting a named vulnerability, for example a ransomware crew exploiting the unpatched VPN appliance, and assign a control owner to each vulnerability.