Information Risk Management, 2nd Edition

5 THREAT AND VULNERABILITY ASSESSMENT

In 2002, US Secretary of State Donald Rumsfeld said the following during a briefing:

… there are known knowns; there are things that we know that we know. We also know there are known unknowns; that is to say we know there are some things we do not know. But there are also unknown unknowns, the ones we don’t know we don’t know.

This is partly true of threats, but very true of vulnerabilities.

Threats, as we see in the glossary in Appendix I, are the ‘potential cause of an unwanted incident, which can result in harm to a system or organisation’. Threats are slightly different from hazards, which may still cause an unwanted incident resulting in harm to an information asset, but whereas threats are generally ...