Difference Between Vulnerability and Threat

Vulnerability vs Threat

Risk, threat, and vulnerability are terms used in connection with security of a system or a business model. These are also terms that are often confused, especially vulnerability and threat. Vulnerability is intrinsic to an individual, machine, system or even entire infrastructure. It is akin to the proverbial Achilles Heels, which is utilized by adversaries or people with malicious intention, to create threat or threat perception. Despite such clear cut difference, there are many who find it difficult to differentiate between the two terms and often confuse between threat and vulnerability. This article tries to remove doubts from the minds of readers regarding threat and vulnerability.

If a person points a gun at you, he is creating real threat to you. But if you shoot the man first, you have eliminated the threat. However, you continue to be vulnerable to such attacks in the future. But if you wear a bullet proof jacket, you reduce your vulnerability though there still are threats to you in the form of people who may try to do harm to you.

Threat

Threat is extrinsic to a system and may be real or perceived. It is a potential cause of harm or undesirable impact to an individual, organization or a system. Threat tries to take advantage of vulnerability or weakness that is intrinsic to a system. For example, hackers, viruses and malicious software are all threats to your computer from the internet if you have not got installed a strong antivirus leaving your computer vulnerable to such attacks or threats.

Assets are always under threat of being attacked, damaged or destroyed by external dangers that can exploit vulnerability or weaknesses that are inherent to the system. An asset is always sought to be protected against threats from external agents. In general, people, property and information are main assets and all the time we are preparing to meet the challenges posed by external threats.

Vulnerability

Vulnerability is the weakness in a system or organization that is made use of by threats to gain access into the system. Any flaw or inherent weakness in a system, which can be utilized by a threat, to gain access, causing harm to the system, is what commonly referred as vulnerability. Vulnerability is a condition of weakness and thus a state of being exploited by threats.

What is the difference between threat and vulnerability?

• The analysis of both vulnerability and threat is vital to calculating the risk to an asset.

• The equation A + T + V = R, tells us that the risk to an asset (A) is the total of threats to it along with its vulnerability.

• Eliminating risk involves both reducing threats as well as vulnerabilities of a system.

• Threat is extrinsic to a system, whereas vulnerability is an inherent weakness of a system.

• Vulnerability is utilized by an attacker, to create a real threat to a system.