1.1Foundations of security principles

In security work, precisely separating what "dangerous" actually means decides the speed and correctness of your response. A window that will not lock (a weakness), a burglar trying to enter through it (a danger), an actual tool to pry it open (a means), and how likely and how large the damage would be (an estimate) are each distinct concepts. Starting from the four terms vulnerability, threat, exploit, and risk, this section covers the entry point of an attack (attack vector), the fortifying of defenses (hardening and defense in depth), the goals to protect (CIA), and the types of attackers and the code of ethics a technician upholds—learned not by rote but through the lens of classifying a situation correctly.

1.1.1Distinguishing vulnerability, threat, exploit, and risk

• A vulnerability is a weakness or flaw in a system or procedure (an unpatched system, a weak password, an open port). A threat is a dangerous event or actor that could exploit that weakness to cause harm (an attacker, malware, a disaster). The weakness itself and the danger targeting it are different things.
• An exploit is the concrete means or code that actually abuses a vulnerability (an attack tool or technique). A risk is the estimate of the probability and impact of loss when a threat strikes a vulnerability. Risk is not the same as a vulnerability: even with a weakness, if exploitability or asset value is low, the risk is small.
• The four relate as: "a threat (burglar) approaches a vulnerability (open window) via an exploit (prying tool), and you estimate the risk (likelihood times size of damage)." Not mixing up which term you are discussing is the first step to prioritizing countermeasures.

1.1.2Attack vectors, hardening, defense in depth, and CIA

• An attack vector is the path or entry point an attacker uses to break in (a phishing email, an open port, a USB stick, a vulnerable web app). The attack surface is the total set of exposable entry points, and shrinking it is the basic defensive stance.
• Hardening shrinks the attack surface by disabling unneeded services and accounts, applying patches, and enforcing least privilege. Defense in depth does not rely on a single control but layers multiple defenses—perimeter, network, endpoint, data—so that if one layer is breached, the next holds.
• CIA is the trio of goals information security protects: Confidentiality (only the authorized can read), Integrity (not tampered with, correct), and Availability (usable when needed). Link each incident to the property it harms (a leak = confidentiality, tampering = integrity, DoS = availability).

Suppose you are the security lead at a small company and a vulnerability scan reports "an old internal test server has an unapplied patch." Reflexively concluding "a vulnerability was found, so it is a critical risk to fix top-priority right now" is not an accurate judgment, because the mere existence of a vulnerability (weakness) and how much risk (probability times impact) it actually poses are separate matters. What to calmly check is whether there is an externally reachable attack vector to that server (is it exposed to the internet or on an isolated internal network), whether a real exploit exists and an attacker as a threat is realistic, and the value of the data the server handles (which CIA property is harmed and how much). If it is on an isolated network with no real data, the same vulnerability carries low risk and lower priority. Conversely, the same vulnerability on an externally exposed server holding customer data is high risk and demands immediate action. As countermeasures, hardening—disabling unneeded services and applying patches—shrinks the attack surface, and layering perimeter, network, and endpoint as defense in depth means that even if one weakness remains, damage is contained. The key idea: estimate risk by multiplying not just "is there a vulnerability" but "how real is the threat, does an exploit exist, and what is the asset value," and prioritize limited effort accordingly. Rather than chasing every weakness in a panic as equals, act in order of the largest risk—this is the basic discipline of security response.

1.1.3Section summary

• Vulnerability (weakness) / threat (danger that could exploit it) / exploit (means of abuse) / risk (probability times impact) are distinct, and risk is not a vulnerability
• Shrink the attack surface with hardening and layer defenses with defense in depth; an attack vector is the entry point of intrusion
• The goals to protect are CIA = confidentiality/integrity/availability; link each incident to the property it harms