ITPEC IP April 2025 Question 37

Inappropriate password management — a weakness that attackers can exploit, so a vulnerability.

Risk assessment separates two things:

• •Threat: a potential cause of harm to information assets: malware, attacks, eavesdropping, disasters, human error
• •Vulnerability: a weakness in the assets or their controls that a threat can exploit: weak or shared passwords, unpatched software, missing encryption, lax procedures

Passwords that are easy to guess, written on a sticky note or shared among staff are a condition of the organisation's own controls, a weakness that lets unauthorised access succeed. That makes it a vulnerability.

Answer (d)

Why not others:

• •(a) Computer virus — malware that infects and damages systems, a threat
• •(b) Social engineering — tricking people into revealing passwords or information, an attack method and so a threat
• •(c) Tapping of communications data — eavesdropping on data in transit, a threat

Key rule: A threat is something that acts on the assets, a vulnerability is a weakness in them; risk arises only when a threat can exploit a vulnerability, so removing weaknesses lowers risk even when threats remain.

Security · AI-written, may contain errors