Notes

Risk is the likelihood that a threat can exploit a vulnerability to cause some type of damage.
Therefore, when you perform an analysis to determine if a risk exists, you need to not only identify
potential threats, but also determine if there are vulnerabilities in your systems that those threats
could exploit. Once you are sure that a risk exists, you can determine the severity of the risk based
on how much damage the risk could cause and how likely it is to occur.


The number one weak link for businesses when it comes to cyber security — by a long, long way — is the people who work in the business.
From falling for phishing emails, and clicking on links or downloading documents that turn out to be malware, to being a victim of business email compromise (BEC) scams that end up losing the company a lot of money, employees are a company’s greatest liability when it comes to cyber security.
Tackling this problem can be difficult for employers: simply getting rid of employees isn’t an option when you need them to run your business! Educating employees on cyber risks is a key step, but this does require resources, and the participation of employees. This may sometimes be difficult, as employees who have “always” done things a certain way may be reluctant to change. However, it is key for businesses that employees understand the risks that poor cyber security practices present for the business. In many cases, people are the weakest link in a business’ cyber security.




Some examples of vulnerability-assessed threats may include the following:
• If a business is located next to railroad tracks and a train derails, leaking toxic fluids, the business
might be forced into inactivity for days or weeks while cleanup occurs.
• If key manufacturing staff express their plans to strike, they may threaten to damage equipment
beforehand to heighten the impact of their impending actions.
• A key supplier may be unable to provide raw materials for the production of an organization's
principal products.