Great, so now let's begin with the definition of a threat in this lecture.
We will talk about the definition of a threat, different types of threats and the relationship between
vulnerability and threat.
So now what is a direct threat is a potential cause of an unwanted incident that takes place in an organization
which can result in harm to the system, all different assets to an organization.
Now, a threat has the potential to actually harm the assets like information processes, systems,
people and even the entire I.T. infrastructure.
So basically, threat is something that can cause damage to your entire organization.
Even one small vulnerability can cause the damage.
Now, threats can be natural or human origin.
That is intentional threat.
Someone is trying to, you know, explicitly do something about your organization to your servers or
they may be accidental.
For example, someone might have left their password open on their desk in order to remember for them.
But a malicious bad guy tries to dig into that and then exploit the entire system.
So both accidental and deliberate threat sources should be identified.
And that is why security audits are important.
A threat can arise from within or from outside.
The organization as well should be identified generically and by the type that is unauthorized actions,
physical damage, technical failures, et cetera.
Now, by definition, a threat has the potential to harm the assets, such as information processes
and systems.
And threats are associated with negative aspect of risk and such, therefore to undesirable occurrences.
Now, in interviews, while you interviews, a simple language should be used to facilitate the discussion
on threats.
So when you go to an interview, you keep in your mind that the threat is nothing but a potential cause
of an unwanted incident.
Now let us have a look at the different types of threats, physical damage, which can include fire
or water damage.
Natural events can also be a threat.
For example, volcanic eruptions, floods, then lightning loss of essential services, which means
a failure of air conditioning, of water, supply of system, loss of power supply.
That is a loss of essential service.
And it can be a threat to.
Disturbance due to radiation, which can include electromagnetic radiation or thermal radiation, technical
failures includes equipment failure, software malfunction or, you know, irregular behavior of a software,
unauthorized actions, which means unauthorized use of data, collection of data data tamper and data
theft and finally compromise of function.
That is the error in use, abuse of rights, upper management, abusing the rights in order to exploit
some things are also a type of threats.
Now, Annex C of Iesu provides a typology for the classification of threats, and we must use annexure
C as a guide to start a checklist to help organizations in structuring and collaboration of different
types of threats.
Now there is a great relationship between a vulnerability and a threat, and it is very important for
you to actually understand this relationship because the presence of a vulnerability itself does not
produce or damage.
A threat must exist to exploit it.
I repeat my sentence again.
I'm saying that the presence of venerability itself does not produce damage.
A threat must exist to exploit that when the liberty in order to cause harm to the organization.
Now, let's consider that this is the vulnerability.
OK, I'll just take my pen.
This is the vulnerability.
And then what is the threat?
The threat can be a theft in the organization.
If the warehouse is left without surveillance, if there is no security guard in the warehouse, someone
can take data or equipment from the warehouse.
So that can result in to a theft.
And this theft, this theft here is a type of threat.
And this is over the next complicated data, which can include data input, error.
So in this very complicated data gathered into data input error, the next is no segregation of duties,
which means fraud, unauthorized access to information and, you know, malicious use of the information
to gain leverage is a theft if the liberty of no segregation duties is exploited unencrypted data.
So if the vulnerability is unencrypted data information theft can be a threat to an organization.
So I hope you're understanding what I am seeing.
That, on the other hand, a threat that is not vulnerable cannot represent a risk.
So if the data is encrypted, then there is a threat of having information theft and that is a risk
to an organization.
Now, note that the incorrect implementation or use of a malfunction of a control could itself represent
a threat if the security controls are not implemented properly, that itself, it can represent a threat
to an organization.
So Arktos, an important role when it comes to security controls.
And that is why it is good to have an experienced and qualified auditor in order to police the security
controls.
So I hope you are understood that this relationship between a vulnerability and a threat.
So if the liberty is exploited, then there is a possibility of a threat.
So this was it for this lecture we saw what is a threat we saw what are the types of different threats
and we saw the relationship between the vulnerability and threat.
Now, I will see you in the next lecture.