## Threats, Vulnerabilities, and Exploits

The "Holy Trinity" of InfoSec. You must master these definitions.

### 1. Vulnerability (The Lock is Broken)
A flaw or weakness in system security procedures, design, implementation, or internal controls.
*   **Software Vulns**: SQL Injection, Buffer Overflow.
*   **Hardware Vulns**: Meltdown/Spectre (CPU flaws).
*   **Human Vulns**: Gullibility (Phishing), Laziness (Weak passwords).
*   **CVE (Common Vulnerabilities and Exposures)**: The global ID system for vulns. e.g., `CVE-2021-44228` (Log4j).

### 2. Threat (The Thief)
Any circumstance or event with the potential to adversely impact operations.
*   **Adversarial Threats**: Hackers, Nation States, Insiders.
*   **Environmental Threats**: Floods, Earthquakes, Power Failure.
*   **Accidental Threats**: Users deleting the wrong database.

### 3. Exploit (The Key)
Code or a technique that takes advantage of a vulnerability.
*   **Zero-Day Exploit**: An exploit for a vulnerability that the vendor (e.g., Microsoft) does **not** know about yet. There is no patch. These are worth millions on the black market.
*   **Public Exploit**: Code available on Exploit-DB or GitHub.

---

### The Equation of Risk
> **Risk = Threat × Vulnerability × Impact**

*   **Scenario A**:
    *   Threat: High (Nation State).
    *   Vuln: High (Unpatched Server).
    *   Impact: High (Database with all customer SSNs).
    *   **Result**: CRITICAL RISK.

*   **Scenario B**:
    *   Threat: High.
    *   Vuln: High.
    *   Impact: Low (The server hosts the cafeteria menu).
    *   **Result**: LOW RISK.

**Risk Management** is about lowering one of these variables.
*   We can't lower the **Threat** (Hackers exist).
*   We can lower the **Vuln** (Patching).
*   We can lower the **Impact** (Network Segmentation, Backups).