Information Security Handbook

Pairing threats with vulnerabilities

Now that you have established your information security vulnerabilities, it is time to begin pairing your vulnerabilities with the threats previously defined.

A threat without a vulnerability does not pose a risk to the organization. The inverse of this is also true in that a vulnerability without a threat does not pose a risk. The key is to establish your threat and vulnerability pairings so that you can identify what vulnerabilities your organization has that can be paired with valid threats. It is a valid pairing that generates risk for your organization, and this exercise allows you to identify what risks need to be addressed.

In the following example, we have taken the vulnerabilities and threats ...