Threats, Vulnerabilities, and Risk Management
What this domain tests
This domain tests whether you can distinguish threats, vulnerabilities, and risk, then prioritize defensibly. Expect CVSS, CVE, EPSS, threat modeling, attack frameworks, supply-chain risk, and risk treatment options.
Core rules
- A threat is a potential cause of harm; a vulnerability is a weakness; risk is the combination of likelihood and impact.
- CVSS base scores rate technical severity, not organizational risk. Context such as exposure, data sensitivity, and compensating controls changes priority.
- CVE identifies a specific vulnerability; EPSS estimates the probability of exploitation in the near term.
- Risk treatment options are mitigate, transfer, avoid, and accept. Transferring risk, for example through insurance, does not eliminate it.
- Threat modeling such as STRIDE identifies design weaknesses before deployment. MITRE ATT&CK maps adversary tactics and techniques; the Cyber Kill Chain describes attack stages.
Worked example
Two findings: a CVSS 9.8 vulnerability on an isolated lab server with no data, and a CVSS 7.5 vulnerability on an internet-facing VPN with known exploitation. The second is usually the higher priority because exposure and exploitation likelihood are greater. Patch the VPN first, add detection, and document the lab remediation plan.
Traps that cost marks
- Ranking by CVSS alone and ignoring exposure or exploit activity.
- Calling risk acceptance the same as ignoring risk; acceptance must be documented and owned.
- Forgetting that a zero-day has no patch, so mitigation and detection matter.
- Treating supply-chain risk as only software licensing.