How do threats and vulnerabilities differ?

• A. A threat is an actual incident; a vulnerability is a policy.
• B. A threat is a weakness; a vulnerability is a potential cause of harm.
• C. A threat is a potential cause of harm; a vulnerability is a weakness that can be exploited.
• D. A threat only refers to external attacks; a vulnerability is only internal.

Answer: (C)

The correct distinction is that a threat represents a potential cause of harm, while a vulnerability signifies a weakness that can be exploited. In the context of network security, threats are any potential dangers that could exploit vulnerabilities to inflict harm on an organization's information systems or information. This could include malicious attacks, natural disasters, or unintended events. On the other hand, vulnerabilities are weaknesses or gaps in security measures that make an organization susceptible to threats. For instance, outdated software or unpatched systems can be considered vulnerabilities, as they can be exploited by threats.

Understanding this relationship is crucial for developing robust security strategies. By identifying threats and assessing vulnerabilities, organizations can prioritize their defenses and implement appropriate countermeasures. This difference underlines the proactive measures necessary to secure systems from risks by not only addressing existing vulnerabilities but also anticipating potential threats that could exploit those weaknesses.