These are the differences between vulnerability and threat.

Although there are many people that use them as synonyms, in reality they are two different things, related but different.

Published in Computerhoy.com by Sandra Arteaga

Main illustration Gerd Altmann in Pixabay

Today, with the news related to cyber-security in all the covers, we're more than accustomed to listen to or read the concepts threat or vulnerabilityAlthough there are many people that use them as synonyms, in reality they are two different things, related but different.

Explained in a fast way, in short, the vulnerabilities are the conditions and characteristics of the systems that make them susceptible to the threats.Therefore, it is necessary that there be a vulnerability for which there is a threat. However, we are going to be defined in detail for an understanding of both concepts.

What is vulnerability

To understand the difference between vulnerability and threat, in the first place we have a clear definition of each one of them. Vulnerability computer is this a fault or weakness in the information system that puts in danger the security, and therefore compromise the integrity, availability or confidentiality of the data. For this reason, it is of vital importance to find these holes as soon as possible, so as to be able to find solutions quickly.

What is a threat

A threat refers to the action that exploits a vulnerability to compromise the security of an information systemIt can come from malicious attacks, events, physical or neglect, and institutional decisions, and can be internal or external to the talk about organizations.

Sources of more common threats are the following:

• Malware: it gives attackers many opportunities to exploit the computer, whether it's spying on personal and private data or carrying out any malicious action with the goal of hurting the victim.
• Social engineering : it is the employment of techniques of persuasion to trick users with malicious intent, such as theft of information, and then carry out other attacks or to sell data on the black market.
• APT or advanced persistent threats: they are coordinated attacks that apply social engineering, targeted against an organization with the goal of stealing or filter information without being detected.
• Botnetsa network of infected computers controlled by the attackers that are used in other most sophisticated attacks, such as denial of service attacks or ddos.
• Cloud services: cloud services: it is also a common source of threats for computers.

Another factor to take into account: the risk.

Risk must also be taken into account in this operation. It is the possibility of a security issue, and it materializes in the event of loss or damage. to measure it, it is necessary to determine the probability that a threat exploits a vulnerability and causes harm or impact. In function of the values obtained is set to a level of risk or the other.

It is very important to try to quantify the risk and put the appropriate measures in order to reduce, as in this way they decrease the chances of occurrence of a security problem.