Tutorial 2: Threats, Vulnerabilities, and Controls

Unit 1 · Security foundations and risk

Objectives

Distinguish threat, vulnerability, exploit, impact, and control.
Map preventive, detective, corrective, and compensating controls.
Use attack surface and exposure to prioritize work.

A threat is a potential cause of harm; a vulnerability is a weakness; an exploit is a method of taking advantage of that weakness. Impact describes the consequence. Controls reduce likelihood, impact, or recovery time. A patch is not a threat, and an attacker is not a vulnerability: precise language improves decisions.

Vulnerability: public storage bucket
Threat: unauthorized party enumerates its URL
Impact: disclosure of student documents
Preventive control: deny-by-default policy
Detective control: access anomaly alert

Controls can be preventive, such as input validation; detective, such as audit logging; corrective, such as restore from backup; or compensating, such as network isolation when a legacy system cannot be patched. Prioritize externally exposed, reachable, exploitable, and high-impact weaknesses.

Exercises

Classify five examples as threat, vulnerability, exploit, impact, or control.
Design one preventive and one detective control for leaked credentials.
Rank three vulnerabilities using exposure, exploitability, and impact.

Self-check

How is a vulnerability different from an exploit?
What is a compensating control?
Why does exposure affect priority?

Self-Check Quiz

1. What is a vulnerability?

Answer

A weakness or condition that can be used to cause an adverse security outcome.

2. What type of control is an alert?

Answer

Usually detective, because it identifies suspicious activity after or during an event.

3. Is every vulnerability equally urgent?

Answer

No. Exposure, exploitability, affected asset, impact, and existing controls change the risk.

Homework

Assess an exposed web service with five weaknesses.
Map each weakness to controls and an owner.
Write a one-page remediation priority rationale.

Sample answer

Prioritize a remotely exploitable authentication bypass affecting sensitive records above a low-impact information leak. Assign owners and deadlines, apply a temporary compensating control if a patch is delayed, and add a verification test to prove remediation rather than relying on a change ticket alone.