Question

A security analyst at a mid-sized company reviews a report showing that a public-facing web server is running an outdated version of software with a known flaw that could allow remote code execution. The report also notes that automated scanning tools operated by attackers routinely probe the internet for this exact flaw. In risk management terms, how should the analyst classify the outdated software with the known flaw?

Accepted Answer

It is a vulnerability — a weakness that could be exploited by a threat.

Answer

It is a threat — the source of potential harm to the asset.

Answer

It is the likelihood — the probability that harm will occur.

Answer

It is the impact — the magnitude of harm if the event occurs.