A risk workshop notes that a phishing group is targeting the sector, that an internet-facing server is missing a security patch, and that customer records could be exposed if the server were compromised. Which statement correctly classifies these elements?
Select an answer to reveal the explanation.
Short Explanation
Picture a burglar, an unlocked window and the chance your jewelry walks out the door. The burglar's the threat, the window's the vulnerability, and the likelihood and impact of losing the jewelry is the risk. The trap is swapping these words around, because they sound alike but mean very different things.
Full Explanation
Risk vocabulary is precise, and the CISM exam relies on it. A threat is anything capable of acting against an asset, such as a criminal group, malware or a natural event; here, the phishing group. A vulnerability is a weakness that a threat could exploit, such as a missing patch on an exposed server. Risk combines the two with the asset at stake: it is the likelihood that the threat exploits the vulnerability and the impact that results, here the potential exposure of customer records. Calling the missing patch a threat and the group a vulnerability reverses the agent and the weakness; a patch gap cannot act, and a criminal group is not a flaw in the organization. Calling the group the risk and the patch the threat confuses the source of harm with the measured outcome. Treating both the group and the patch as vulnerabilities removes the threat entirely and leaves nothing that could exploit the weakness. Exam caveat: impact on its own is not risk; without likelihood, the analysis is incomplete. Operational check: review a sample of risk register entries and confirm each names a distinct threat, vulnerability, affected asset, likelihood and impact rather than mixing them.