Learn in the textbookThe Risk Assessment Process
DefinitionInformation security risk (情報セキュリティリスク) is the possibility that a threat exploits a vulnerability and causes damage to an information asset.
ExplanationA threat is an event that causes damage, and a vulnerability is a weakness on the defender's side that a threat can exploit. Either one alone rarely leads to damage, but the risk grows when both are present. Risk assessment is the activity of finding these risks, measuring their size and deciding whether they need treatment.
AnalogyPicture a neighborhood where burglars are active (the threat) and a house whose back-door lock is broken (the vulnerability). The chance that the family's belongings get stolen is itself the risk.
Memory hook"Vulnerable" comes from the Latin word for a wound: it describes the side that can be hurt, the defender, not the side that attacks.