Foundations of Cyber Threats and Vulnerabilities

Introduction

Cybersecurity begins with a simple question: what must be protected, from whom, and against what kinds of harm? Organisations depend on information, software, devices, networks, people, facilities, and services. These resources are exposed to accidental events, technical failures, criminal activity, espionage, sabotage, and misuse. Effective cybersecurity therefore requires more than installing security software. It requires a shared vocabulary and a disciplined way to reason about uncertainty.

This chapter introduces the foundational concepts used to describe cyber risk. It distinguishes assets, threats, threat actors, vulnerabilities, exploits, exposure, controls, likelihood, impact, and risk. It also explains the principal security objectives—confidentiality, integrity, availability, authentication, and non-repudiation—and shows how they guide practical protection decisions.

Learning Objectives

By the end of this chapter, you should be able to:

• define asset, threat, threat actor, vulnerability, exploit, exposure, control, likelihood, impact, and risk;
• distinguish a threat from a vulnerability and an exploit;
• explain how confidentiality, integrity, availability, authentication, and non-repudiation support trustworthy systems;
• apply a basic risk model to a realistic scenario;
• identify preventive, detective, corrective, and deterrent controls; and
• recognise the ethical, governance, and operational responsibilities associated with cybersecurity.

1. The Cybersecurity Problem

Cybersecurity is the practice of protecting digital and digitally connected resources against unauthorised actions and harmful events. Its scope includes confidentiality of data, correctness of information, continuity of services, identity assurance, accountability, privacy, and resilience.

A modern organisation is a socio-technical system. Technology matters, but so do people, procedures, suppliers, laws, incentives, and organisational culture. A technically secure server can still be compromised if an administrator shares credentials, if a supplier has excessive access, or if a recovery plan has never been tested.

Security decisions are also decisions under uncertainty. An organisation rarely knows exactly when an attack will occur, whether a control will work perfectly, or how much damage a failure will cause. Risk management provides a structured method for making reasonable, proportionate decisions despite that uncertainty.

2. The Core Vocabulary of Cyber Threats

Assets

An asset is something of value that an organisation or person seeks to protect. Assets include more than files and computers. Examples are:

• customer records, research data, credentials, and intellectual property;
• applications, databases, operating systems, and source code;
• laptops, servers, industrial controllers, mobile devices, and network equipment;
• business processes such as payment, clinical, manufacturing, or emergency services;
• cloud resources, supplier connections, and communications channels;
• reputation, safety, legal standing, and public trust; and
• the availability of staff knowledge and organisational capability.

Asset value depends on context. A public marketing webpage may have low confidentiality requirements but high availability and integrity requirements. A payroll database may require strong confidentiality and integrity, while a hospital monitoring system may place life-critical emphasis on availability and integrity.

Threats

A threat is a potential cause of an unwanted incident. Threats may be intentional, accidental, environmental, or technical. Examples include phishing, ransomware, insider misuse, power failure, fire, software defects, hardware failure, and accidental deletion.

A threat is not itself an incident. A phishing campaign is a threat; a successful theft of credentials through that campaign is an incident. Threat descriptions should identify the harmful event or condition and, where possible, the asset or objective that could be affected.

Threat actors

A threat actor is an individual, group, organisation, or state capable of carrying out a threat. Common categories include:

These categories are analytical aids rather than rigid labels. An actor may have multiple motivations, and attribution can be uncertain. Security teams should avoid assuming that all threats come from external attackers.

Vulnerabilities

A vulnerability is a weakness or condition that could be used to cause harm. Vulnerabilities may exist in software, hardware, configuration, processes, architecture, or human behaviour. Examples include an unpatched web server, excessive permissions, weak passwords, an exposed management interface, inadequate backup procedures, and insufficient security training.

A vulnerability is not automatically a breach. A weakness may remain unused, or other controls may prevent exploitation. Vulnerability management involves identifying, validating, prioritising, remediating, and monitoring weaknesses.

Exploits

An exploit is a method, code sequence, technique, or procedure that takes advantage of a vulnerability. For example, a crafted input that causes a vulnerable application to execute unauthorised commands is an exploit technique. A publicly available exploit tool may be used by defenders during testing or by attackers during compromise.

The distinction is important:

• the unpatched software defect is the vulnerability;
• the attacker or malicious process is the threat actor;
• the technique used to abuse the defect is the exploit; and
• the resulting unauthorised access or damage is the incident or consequence.

A vulnerability can exist without a known exploit, and an exploit can be ineffective when compensating controls, authentication, network segmentation, or secure configuration block it.

Exposure

Exposure describes the condition of being open or susceptible to a threat. Exposure may result from internet reachability, excessive privileges, weak authentication, poor physical protection, untrusted dependencies, or lack of monitoring.

Exposure is related to vulnerability but is not identical. A vulnerable service isolated from all untrusted networks may have limited exposure. A well-designed application placed on an unrestricted public interface may have substantial exposure even if no specific defect is currently known.

Controls

A control is a safeguard or measure that modifies risk. Controls may be technical, administrative, physical, or environmental. Examples include multi-factor authentication, access reviews, secure development practices, firewalls, encryption, security awareness training, visitor procedures, backups, and incident-response plans.

Controls are often classified by purpose:

• Preventive controls aim to stop an unwanted event, such as least-privilege access or input validation.
• Detective controls identify events or conditions, such as logging, intrusion detection, or file-integrity monitoring.
• Corrective controls reduce harm or restore operations, such as patching, malware removal, and recovery from backups.
• Deterrent controls discourage harmful behaviour, such as visible monitoring, sanctions, and warning notices.
• Compensating controls provide an alternative reduction in risk when the preferred control cannot yet be implemented.

Controls are not perfect barriers. They can fail, be bypassed, be incorrectly configured, or create new operational risks. Defence in depth therefore uses multiple, independent or partially independent safeguards.

3. Security Objectives

Confidentiality

Confidentiality is the property that information is not disclosed to unauthorised individuals, entities, or processes. Access control, encryption, data classification, secure disposal, and privacy procedures support confidentiality.

Confidentiality failures include a stolen password, accidental email disclosure, an exposed cloud storage bucket, and unauthorised employee browsing. Confidentiality is not the same as secrecy in every circumstance: authorised sharing is compatible with confidentiality when it follows defined rules.

Integrity

Integrity is the property of accuracy, completeness, consistency, and protection from unauthorised or improper modification. Integrity applies to data, software, configurations, transactions, and records.

Digital signatures, hashes, write controls, transaction validation, version control, segregation of duties, and audit logs can support integrity. A ransomware attack that encrypts files, an attacker who changes a bank account number, and a faulty sensor that reports false readings are all integrity concerns.

Availability

Availability is the property that authorised users can access information and services when required. Redundancy, capacity planning, resilient architecture, patching, backup, disaster recovery, and denial-of-service protection support availability.

Availability is not necessarily continuous operation at any cost. It is defined against business requirements. A service required during working hours may have different availability needs from an emergency response service that must operate continuously.

Authentication

Authentication is the process of establishing that an entity is who or what it claims to be. Authentication factors commonly include:

1. something the user knows, such as a password or PIN;
2. something the user has, such as a hardware token or registered device; and
3. something the user is, such as a fingerprint or facial characteristic.

Multi-factor authentication uses two or more distinct factor types. Using a password and a second password is not genuine multi-factor authentication because both are knowledge factors. Authentication should be distinguished from authorisation, which determines what an authenticated entity is permitted to do.

Biometric systems require careful design because biometric characteristics cannot generally be replaced like passwords if compromised. Authentication also depends on secure enrolment, credential recovery, session management, and protection against phishing and replay.

Non-repudiation

Non-repudiation provides evidence supporting the origin, submission, receipt, or integrity of an action so that a party cannot credibly deny it later. Digital signatures, trusted timestamps, tamper-evident logs, and controlled audit trails can contribute to non-repudiation.

Non-repudiation is stronger than simply recording a username in a log. If credentials can be shared or stolen, a username alone may not prove who performed an action. Technical evidence must be supported by sound key management, identity processes, time synchronisation, access control, and applicable legal rules. No technology automatically settles every legal dispute.

These objectives are often summarised as the CIA triad—confidentiality, integrity, and availability. Authentication and non-repudiation extend the model by addressing identity and accountability. Other objectives, including privacy, safety, authenticity, and resilience, may also be essential in particular sectors.

4. From Threat to Risk

Risk analysis connects the preceding concepts. A typical chain is:

Asset → threat actor or source → threat event → vulnerability or exposure → incident → impact

For example, a customer database is an asset. A criminal group is a threat actor. Credential theft is a threat event. Weak authentication is a vulnerability and public administrative access is an exposure. Unauthorised database access is the incident. Regulatory penalties, fraud, privacy harm, and loss of trust are possible impacts.

Likelihood

Likelihood is an estimate of how probable or credible an event is within a defined period and context. It may be informed by threat intelligence, historical evidence, exposure, actor capability, control effectiveness, and opportunity. Likelihood is not a guarantee and should not be presented with false precision.

Impact

Impact is the magnitude of harm if an event occurs. Impacts may involve financial loss, operational disruption, safety, privacy, legal obligations, reputation, strategic advantage, or harm to other organisations and individuals. Impact should be assessed against the affected stakeholders and relevant time horizon.

Risk

Risk is the effect of uncertainty on objectives. In introductory cybersecurity practice, risk is often represented by the heuristic:

Here, likelihood is an estimate of the chance or frequency of the event, and impact is the magnitude of its consequences. The expression is a prioritisation model, not a universal physical law. It is most useful when the scales are defined consistently—for example, ordinal ratings from 1 to 5—and when the organisation recognises that multiplication of ordinal scores does not create precise monetary probability.

A quantitative expected-loss model can be used when credible numerical data exist:

P(event) is the probability of the event over a specified period, and the loss term must use a defined unit such as currency. The model assumes the probability and loss estimate are meaningful for the same scenario and time period. It does not capture every dependency, uncertainty, cascading effect, or non-financial consequence.

For a simple example, suppose a business estimates a 10% annual probability of a particular compromise and a direct annualised loss of £40,000 if it occurs. The estimated loss is:

0.10 × £40,000 = £4,000 per year.

This does not mean that the organisation will lose exactly £4,000, nor does it justify spending £4,000 automatically on controls. Control costs, residual risk, uncertainty, legal duties, safety, and the value of prevention must also be considered.

Inherent and residual risk

Inherent risk is the risk before considering controls. Residual risk is the risk remaining after controls are applied. Controls may reduce likelihood, impact, or both. Risk acceptance should be an explicit decision by an appropriately authorised person; it should not occur merely because a weakness is inconvenient to fix.

Risk assessment is iterative. Systems change, new vulnerabilities appear, threat actors adapt, and controls degrade. Reviews should therefore occur after significant changes and at appropriate intervals.

5. A Practical Risk-Assessment Method

A basic certificate-level assessment can follow these steps:

1. Establish context. Define the system, business purpose, stakeholders, time period, and assessment criteria.
2. Identify assets. Record what the system supports and why it matters.
3. Identify threats and actors. Consider criminal, insider, accidental, technical, environmental, and supply-chain sources.
4. Find vulnerabilities and exposure. Examine configuration, software, identity, process, physical, and human weaknesses.
5. Estimate likelihood and impact. Use consistent scales and document assumptions.
6. Identify existing controls. Consider their design, implementation, coverage, and reliability.
7. Determine treatment. Avoid, reduce, transfer, or accept the risk, subject to authority and compliance requirements.
8. Monitor and review. Test controls, track changes, and update the assessment.

Risk treatment options have limits. Insurance may transfer some financial consequences but does not transfer responsibility for protecting people or complying with law. Risk avoidance may remove a business opportunity. Acceptance is appropriate only when informed, documented, and within tolerance.

6. Applied Case: A Community Clinic Portal

The following is an illustrative case, not a report of a real organisation.

Background

A community clinic introduces an online portal through which patients book appointments, view test results, and send messages to clinicians. Staff access the same platform from clinic workstations and occasionally from home.

Problem

A review finds that several staff members share a generic account, some users have access to more patient records than their roles require, and the portal administration interface is reachable from the public internet. Backups exist but have never been tested. The clinic believes that a firewall alone makes the system secure.

Analysis

The patient records, appointment service, and clinical decisions are assets. Confidentiality is critical because health information is sensitive. Integrity is critical because altered results could cause clinical harm. Availability is important because patients and clinicians depend on the portal.

Potential threat actors include cybercriminals seeking extortion, malicious insiders, and opportunistic attackers. Relevant vulnerabilities and exposures include shared credentials, excessive privileges, public administrative access, and unverified backups. A phishing attack against a staff member could lead to account compromise. Ransomware could then affect availability and integrity.

Approach and solution

The clinic should first establish individual accounts and role-based access. Multi-factor authentication should protect remote and administrative access. The administrative interface should be restricted through a secure access path, with network controls and strong monitoring. Patient and staff permissions should follow least privilege, and access reviews should be scheduled.

The clinic should implement tested, protected backups and a recovery procedure. Logs should record access to patient records and administrative actions, with alerts for unusual behaviour. Systems should be patched through a managed process, and staff should receive practical training on phishing, privacy, and reporting. An incident-response plan should define clinical continuity, notification, evidence preservation, and communication responsibilities.

Outcome

These measures do not eliminate risk. They reduce the likelihood of unauthorised access, limit the scope of a compromised account, improve detection, and reduce the impact of system failure. Regular exercises and access reviews are necessary because a control that is not maintained or tested may provide only an assumption of protection.

Learning points

• A firewall is one control, not a complete security strategy.
• Confidentiality, integrity, and availability may all be critical in the same system.
• Shared accounts weaken authentication, accountability, and non-repudiation.
• Backups are a control only when they are protected and can be restored.
• Risk treatment must consider people, processes, technology, and legal duties together.

7. Governance, Ethics, and Professional Responsibility

Cybersecurity professionals operate with authority that can affect privacy, employment, safety, and civil rights. Testing must be authorised, scoped, and documented. Scanning systems without permission may disrupt services or violate law. Evidence must be handled carefully, and personal data should be collected and retained only for legitimate purposes.

Organisations should assign responsibility for risk decisions, access approval, vulnerability remediation, incident reporting, and business continuity. Policies should be understandable and enforceable. Security monitoring should be proportionate, transparent where required, and protected from misuse.

Regulatory obligations vary by jurisdiction and sector, but common themes include protection of personal data, breach reporting, records management, resilience, and accountability. Compliance can establish a baseline, but compliance alone does not prove that a system is secure. Professional judgement remains necessary.

8. Contemporary Developments and Limitations

Cloud services, mobile work, software supply chains, connected devices, and artificial intelligence have expanded both capability and attack surface. Cloud responsibility is shared: a provider may secure underlying infrastructure, while the customer remains responsible for identities, configurations, data, and applications. Software dependencies can introduce vulnerabilities outside an organisation’s direct codebase.

Artificial intelligence can assist with alert triage, pattern recognition, vulnerability prioritisation, and security testing. It can also support phishing, automated reconnaissance, social engineering, and the creation of convincing malicious content. AI outputs require validation because models can be inaccurate, manipulated, biased, or unsuitable for confidential data. Human accountability is not removed by automation.

A further limitation is that risk models simplify reality. Numerical scores can hide uncertainty, dependencies, rare catastrophic events, and distributional effects. A low-probability event may still require action where safety, fundamental rights, or legal duties are involved. Good practice combines structured models with expert review, testing, threat intelligence, and continuous learning.

9. Best-Practice Principles

The following principles provide a practical foundation:

• identify and classify assets before selecting controls;
• apply least privilege and separation of duties;
• use strong, phishing-resistant authentication where feasible;
• patch and securely configure systems according to risk;
• protect sensitive data in transit, at rest, and during disposal;
• maintain central, protected logs and monitor significant events;
• segment networks and limit unnecessary exposure;
• keep resilient, offline or otherwise protected backups and test restoration;
• train users and make reporting mistakes safe and prompt;
• prepare, exercise, and improve incident-response and continuity plans;
• assess suppliers and software dependencies; and
• review risk when systems, threats, business purposes, or regulations change.

These practices work best as a system. For example, encryption may protect confidentiality, but poor key management can undermine it; logging may support detection, but unmonitored logs have limited value; and access controls may be bypassed if account recovery is weak.

Chapter Summary

Cybersecurity is concerned with protecting assets from harmful events under conditions of uncertainty. Assets include information, systems, services, people, reputation, and organisational capability. Threats are potential causes of harm, threat actors are sources capable of causing that harm, vulnerabilities are weaknesses, exploits are methods of abusing weaknesses, and exposure describes susceptibility or openness. Controls modify risk through prevention, detection, correction, deterrence, or compensation.

Confidentiality protects information from unauthorised disclosure; integrity protects accuracy and authorised state; availability supports timely access; authentication establishes identity; and non-repudiation provides evidence that supports accountability. Authentication is distinct from authorisation, and a log entry alone does not necessarily prove who acted.

Risk combines uncertainty with consequences. The introductory relationship Risk ≈ Likelihood × Impact is a useful prioritisation heuristic when scales are defined consistently, while expected-loss calculations require credible probabilities, losses, units, and assumptions. Risk assessment should identify assets, threats, vulnerabilities, exposures, controls, likelihood, and impact, then select and review treatment options. Effective cybersecurity is layered, socio-technical, ethically governed, and continuously improved.

Key Terms

Asset: Something of value that requires protection.

Threat: A potential cause of an unwanted incident or harm.

Threat actor: A person, group, organisation, or state capable of carrying out a threat.

Vulnerability: A weakness or condition that can be exploited.

Exploit: A technique, code sequence, or procedure that abuses a vulnerability.

Exposure: The condition of being open or susceptible to a threat.

Control: A safeguard or measure that modifies risk.

Confidentiality: Protection against unauthorised disclosure.

Integrity: Protection of accuracy, completeness, and authorised state.

Availability: Accessibility of systems or information when required.

Authentication: Establishing that an entity is who or what it claims to be.

Authorisation: Determining what an authenticated entity may do.

Non-repudiation: Evidence supporting the origin or performance of an action.

Likelihood: An estimate of the chance or frequency of an event in a defined context.

Impact: The magnitude of harm resulting from an event.

Risk: The effect of uncertainty on objectives.

Inherent risk: Risk before considering controls.

Residual risk: Risk remaining after controls are applied.

Least privilege: Giving an entity only the access necessary for its legitimate tasks.

Defence in depth: Using multiple layers of complementary security controls.

Review Questions

Short Answer Questions

1. What is the difference between a vulnerability and an exploit?
2. Define confidentiality, integrity, and availability.
3. Why is authentication different from authorisation?
4. What is residual risk?
5. Give two examples of detective controls.

Long Answer Questions

1. Explain how an asset, threat actor, threat, vulnerability, exploit, incident, and impact can be connected in a cyberattack.
2. Discuss the importance of the CIA triad in the design of an online healthcare service.
3. Explain the strengths and limitations of the heuristic Risk ≈ Likelihood × Impact.
4. Compare preventive, detective, corrective, deterrent, and compensating controls, using examples.
5. Describe a practical risk-assessment process for a small organisation.

Analytical / Application Questions

1. A company exposes a remote administration service to the internet and protects it with a single shared password. Identify the assets, threats, vulnerabilities, exposures, likely impacts, and priority controls.
2. A backup system completes successfully every night, but restoration has never been tested. Analyse which security objectives and risks are involved and recommend actions.
3. An employee’s credentials are used to download a confidential database. Explain what additional evidence would be needed to support non-repudiation and how the organisation should investigate ethically and lawfully.

Multiple Choice Questions with Answers

Question 1

Which statement best defines a vulnerability?

A. A person or group that conducts an attack

B. A weakness that could be used to cause harm

C. The damage resulting from a security incident

D. A safeguard that reduces risk

Correct Answer: B. A weakness that could be used to cause harm

Question 2

What is an exploit?

A. A method that takes advantage of a vulnerability

B. An asset requiring protection

C. A policy for classifying information

D. A measure of business impact

Correct Answer: A. A method that takes advantage of a vulnerability

Question 3

Which security objective concerns preventing unauthorised disclosure?

A. Availability

B. Integrity

C. Confidentiality

D. Non-repudiation

Correct Answer: C. Confidentiality

Question 4

Which example provides genuine multi-factor authentication?

A. Two passwords

B. A password and a hardware security token

C. A PIN and a password

D. Two security questions

Correct Answer: B. A password and a hardware security token

Question 5

Which control is primarily detective?

A. File-integrity monitoring that generates alerts

B. Input validation that blocks malicious data

C. A tested disaster-recovery backup

D. A policy requiring annual training

Correct Answer: A. File-integrity monitoring that generates alerts

Question 6

What does least privilege require?

A. Every employee receives administrator access

B. Users receive only the access needed for legitimate tasks

C. Access is granted permanently after hiring

D. All systems use one shared account

Correct Answer: B. Users receive only the access needed for legitimate tasks

Question 7

A scenario has an estimated probability of 0.10 and a loss of £40,000 if it occurs. Using expected loss, what is the result?

A. £400

B. £4,000

C. £40,000

D. £400,000

Correct Answer: B. £4,000

Question 8

Which statement about a firewall is most accurate?

A. It eliminates all cyber risk

B. It replaces authentication and backups

C. It is one control within a broader defence strategy

D. It guarantees confidentiality of all data

Correct Answer: C. It is one control within a broader defence strategy

Question 9

What is residual risk?

A. Risk before a system is designed

B. Risk remaining after controls are applied

C. Risk that has been transferred to an insurer

D. Risk caused only by natural disasters

Correct Answer: B. Risk remaining after controls are applied

Question 10

Which property is most directly supported by digital signatures and tamper-evident audit records?

A. Non-repudiation

B. Availability

C. Physical safety

D. Network capacity

Correct Answer: A. Non-repudiation