5.1Security concepts and the security program

Securing a network is not a matter of "just deploy some appliances and you are safe." In practice you must organize which threat exploiting which vulnerability the risk in front of you actually is, then judge the most cost-effective mitigation for that situation. This section builds the shared vocabulary for discussing security (threat / vulnerability / exploit / mitigation) and the mindset of defense in depth that protects across three fronts: technology, people, and physical space.

5.1.1Threat, vulnerability, exploit, and mitigation

• A vulnerability is an inherent "weakness" in a system (an unpatched OS, a left-in-place default password, a misconfiguration, etc.). A threat is a potential danger that could exploit that weakness to cause harm (an attacker, malware, insider abuse, etc.). Thinking of the vulnerability as "the hole" and the threat as "what is aiming at that hole" keeps the two from being confused.
• An exploit is the concrete means, tool, or code used to actually abuse a vulnerability—it is the "mechanism by which" a threat leverages a vulnerability. A mitigation is a countermeasure that closes a vulnerability or reduces a threat's impact (patching, ACLs, encryption, access control, etc.).
• Risk is the "likelihood and magnitude of impact" of a threat exploiting a vulnerability to cause harm. Mitigation does not reduce risk to zero; it lowers it to an acceptable level. Which vulnerabilities to close first is judged by prioritizing "impact if exploited" against "ease of exploitation."