Threat
Anything that could cause harm, loss, damage or compromise to information technology systems
External threats examples
Cyber-attacks, Natural disasters, Data integrity breaches, Disclosure of confidential information
Vulnerability
Any weakness in the system design or implementation. They come from internal factors
What is coursing vulnerabilities (examples)
Software bugs, misconfigured software, improperly protected network devices, missing security patches, lack of physical security
When risk appears?
When threat and vulnerability intersects
Risk management
Finding different ways to minimize the likelihood of an outcome occurring and achieve the desired outcomes = get outcome you want, not random risky