Fundamentals of Information Systems Security, 4th Edition

Risks, Threats, and Vulnerabilities in an IT Infrastructure

Risks, threats, and vulnerabilities go together. Risk is the probability that something bad is going to happen, a threat is any action that can damage or compromise an asset, and a vulnerability is a weakness in the design or software code itself. If a vulnerability can be exploited, it is a threat.

Because software for all IT assets has bugs or vulnerabilities, many software vendors limit their liability with a stringent End-User Licensing Agreement (EULA). For example, Microsoft has a $5.00 maximum limitation of liability clause once you install an application using a valid product license number. The EULA is what transfers software companies’ risk to its end users from having vulnerable ...