Threats, Vulnerabilities, and Risk

You’ll be able to

Distinguish threats, vulnerabilities, attacks, and risk
Explain why authentication failures are high-value attack paths
Use likelihood and impact to prioritize defenses

Risk is a relationship

Cybersecurity is not just a list of bad things. A threat is an actor or event that can cause harm. A vulnerability is a weakness the threat can exploit. An attack is the attempted exploitation. Risk combines how likely the attack is with how damaging it would be if it succeeds.

Worked example

A student reuses the same password for school email and a gaming account. The gaming site is breached and attackers try the leaked password on the school account.

1.Threat: attackers using credential stuffing.
2.Vulnerability: password reuse and lack of a second authentication factor.
3.Impact: unauthorized access to email, files, accounts, and reset links.
4.Mitigation: unique passwords through a password manager plus multifactor authentication.

Answer: This is high risk because the likelihood is realistic and the impact is broad. MFA reduces the chance that a stolen password alone becomes account access.

Checkpoint

Which statement best describes a vulnerability?

Checkpoint

Two weaknesses have the same likelihood of being exploited. One would expose a public lunch menu; the other would expose student records. How should they be prioritized?

On the exam

For AP Cybersecurity prompts, do not stop at naming an attack. Tie the attack to the exploited weakness and then recommend a control that actually reduces that risk.

Answer the 2 checkpoints as you read.