1.2Threats and vulnerabilities

A security risk only materializes when a threat (an agent or event capable of causing harm) meets a vulnerability (a weakness that allows the harm to occur). Security designers must evaluate these two separately to choose effective countermeasures. An earthquake, for instance, is a threat, but in a seismically reinforced data center the vulnerability is small and the resulting damage is limited. This section builds the perspective needed to evaluate threats and vulnerabilities separately and judge where to invest countermeasure resources.

1.2.1Classification of threats (physical, human, technical)

• Physical threats are threats from physical causes, such as earthquakes, fires, power outages, and theft or destruction of equipment. Countermeasures include seismic and fire-prevention equipment, UPS (uninterruptible power supply), and access management.
• Human threats involve people, such as operational mistakes, loss of information, insider fraud, and social engineering. Countermeasures include training, minimizing privileges, and internal controls.
• Technical threats use technical means, such as malware infection, unauthorized access, and DoS attacks. Countermeasures include patch management, firewalls, and intrusion detection/prevention systems (IDS/IPS).

1.2.2Classification of vulnerabilities (bugs, security holes, human vulnerabilities, shadow IT)

• A bug is a defect in a program's implementation. Bugs that can be exploited by an attacker are security holes (security flaws), addressed through patching and vulnerability management.
• Human vulnerability stems from people—password reuse, careless configuration, lack of security awareness. It cannot be prevented by technical measures alone and requires training, drills, and policy development.
• Shadow IT refers to personal devices or unapproved cloud services that employees use for work without the IT department's authorization or oversight. Because it is invisible to management, it easily falls outside vulnerability management and can become a breeding ground for information leakage or malware intrusion.

1.2.3The OWASP Top 10 and the fraud triangle

• The OWASP Top 10 is a list published by OWASP (Open Worldwide Application Security Project) of the ten most frequent and impactful web-application vulnerability categories. Broken access control, cryptographic failures, and injection consistently rank high, and the list is used to prioritize secure coding in development.
• The fraud triangle models the conditions for insider fraud as the confluence of three elements: opportunity (an environment where fraud is possible), motive (a reason or pressure to commit fraud), and rationalization (convincing oneself the fraud is justified). Fraud is unlikely if even one element is missing, so measures that reduce each element (opportunity -> segregation of duties and monitoring; motive -> improving working conditions; rationalization -> ethics training) are effective deterrents.

Suppose a security designer at a systems development company is deciding where to prioritize security budget and effort for a new web-application project. First, separate threats from vulnerabilities: since this is an externally facing EC site, the expected threats are mainly "technical threats" (unauthorized access, injection attacks), while physical threats like earthquakes are largely already covered by the data center's existing measures. On the vulnerability side, referring to the OWASP Top 10 shows that "broken access control" and "injection" consistently rank high, so the designer decides to focus effort on reviewing authorization logic and automating input-validation testing. In parallel, suppose it turns out that part of the development team has been backing up source code to a personal cloud storage service instead of the official internal system (shadow IT). This is not a technical vulnerability but an unmanaged operational reality, and patch management cannot address it. The designer interviews the team to understand the motive (the internal system is inconvenient) and, applying the fraud-triangle idea, chooses to improve the convenience of the official tool while mandating its use (reducing opportunity). Simply prohibiting the practice by rule alone carries a high risk that, as long as the motive (inconvenience) remains, a different workaround (another instance of shadow IT) will emerge. Threats, vulnerabilities, the OWASP Top 10, and the fraud triangle thus all function as analytical frameworks for deciding where, and in what order, to invest countermeasure resources.

1.2.4Section summary

• Threat (external factor) x vulnerability (internal weakness) = risk. Threats can be classified as physical, human, or technical
• Shadow IT is an operational vulnerability from a lack of management/visibility, distinct from a bug. The OWASP Top 10 is used to prioritize web-application vulnerabilities
• The fraud triangle: insider fraud is likely when opportunity, motive, and rationalization all align. Deter it by reducing any one of the three