VMware ESXi and vSphere Cluster Management

Basic IT Security Terms: Assets, Vulnerabilities, Threats, Risk, and the CIA Triad

Learn the foundations of IT security: assets, vulnerabilities, threats, attacks, exploits, risk, controls, and the confidentiality, integrity, and availability triad.

Why foundational security terminology matters

Effective security begins with a shared vocabulary. Before choosing a firewall, writing a policy, or deploying monitoring, an organization must understand what it needs to protect, what could go wrong, how serious the consequences could be, and which safeguards are appropriate.

A practical security sequence is:

Identify valuable assets.
Identify relevant threats and vulnerabilities.
Evaluate the resulting risk.
Select and operate appropriate countermeasures, also called security controls.

The core security terms are related, but they are not interchangeable. A vulnerability is a weakness, a threat is a potential source of harm, and an attack is an action that attempts to cause harm.

Core security terms and their relationships

Term	What it represents	Example	Relationship to other terms
Asset	A resource with organizational value that should be protected	Customer records or a network router	Threats and vulnerabilities affect assets
Vulnerability	A weakness in technology, design, configuration, process, or physical protection	Overly broad cloud storage permissions	Provides a possible path for a threat to cause harm
Threat	A potential cause of unwanted harm	Malware, an equipment failure, or a malicious insider	May exploit a vulnerability or cause harm through another failure
Threat actor	A person, group, system, or source capable of carrying out a threat	An internet-based attacker	May use an attack and exploit to target an asset
Exploit	A method or tool that takes advantage of a specific vulnerability	Commands sent to trigger a software flaw	Connects a vulnerability to a concrete attack
Attack	An action intended to compromise, disrupt, expose, alter, or obtain an asset without authorization	Downloading exposed customer files	May use an exploit and produce an impact
Impact	The business, technical, legal, financial, or operational consequence of an event	Service outage or regulatory penalty	Helps determine the seriousness of risk
Risk	The potential for loss or adverse impact	Possible data exposure from a public storage bucket	Is influenced by asset value, likelihood, vulnerability exposure, and impact
Countermeasure or security control	A safeguard used to manage security risk	Encryption, patching, or backups	Reduces likelihood, impact, or recovery time

The causal model is: an organization has valuable assets; assets or their supporting environments have vulnerabilities; threat sources may use attacks or exploits against those weaknesses; successful events create impact; that exposure is risk; and controls reduce the risk.

Assets

An asset is anything of value to an organization that warrants protection. Assets are not limited to computers. They include resources that support business operations, contain information, enable services, or contribute to trust.

Types of assets

Physical or tangible assets: laptops, desktops, servers, routers, switches, storage devices, buildings, and backup power equipment.
Digital assets: applications, operating systems, databases, cloud resources, credentials, configuration files, and network services.
Information assets: customer data, business records, financial information, authentication data, and employee records.
Intangible assets: intellectual property, trade secrets, business processes, organizational reputation, and customer trust.

An asset's value can depend on its business importance, sensitivity, replacement cost, legal obligations, and operational dependence. A small configuration file may be highly valuable if it contains credentials. A public marketing page may be less sensitive, but its availability and integrity can still affect reputation.

Asset protection aims to prevent unauthorized viewing, use, modification, deletion, disclosure, theft, and disruption. The required protection should match the asset's value and the consequences of losing control over it.

Asset classification

Asset classification assigns a handling or protection level based on sensitivity and business value. Classification helps determine who may access an asset, where it may be stored, how it should be transmitted, and how long it should be retained. Labels vary by organization, so the following are examples rather than a universal standard.

Classification level	Typical data or asset example	Required handling and access expectations
Public or unclassified	Published product information	May be openly shared; integrity and availability may still require protection
Internal	Routine procedures or internal contact lists	Available to approved personnel; avoid unnecessary external disclosure
Sensitive	Operational details or employee information	Restrict access, use approved storage, and monitor handling
Confidential	Customer records, financial data, or proprietary designs	Strong access control, secure transmission, encryption, and auditing
Secret	Highly restricted strategic or technical information	Access only for specifically authorized roles with enhanced monitoring
Top secret	Extremely sensitive information in organizations that use this label	Exceptional restrictions, formal authorization, and rigorous handling procedures

Vulnerabilities

A vulnerability is a weakness that could defeat or reduce security protections. Vulnerabilities can exist in software, operating systems, protocols, network devices, applications, configurations, processes, physical security, or system architecture.

Common forms of vulnerability

Software flaw: A programming error permits an unexpected or unauthorized action.
Configuration error: A secure feature is disabled, permissions are too broad, or a service is unnecessarily exposed.
Design weakness: The system's architecture lacks an effective security boundary or depends on an unsafe assumption.
Process weakness: There is no reliable patching, approval, review, or account-removal process.
Physical weakness: Equipment is accessible to unauthorized people or lacks environmental protection.

A vulnerability may be deliberately exploited, or it may cause harm when triggered accidentally. For example, an invalid input could be used by an attacker or could cause a service to crash during normal activity.

A vulnerability alone does not necessarily mean that a system has been compromised. A relevant threat and a feasible path to exploitation are also needed. A flaw on an isolated, unused system may present less immediate risk than the same flaw on an internet-facing server containing sensitive data.

Threats and threat actors

A threat is a potential source of harm to an asset or organization. A threat actor is a person, group, system, or other source capable of creating or carrying out that threat.

Intentional threats: malicious outsiders, criminal groups, espionage operators, malicious insiders, and attackers seeking money or disruption.
Accidental threats: careless users, mistaken data deletion, incorrect configurations, and emails sent to the wrong recipient.
Environmental threats: floods, fires, storms, earthquakes, extreme temperatures, and other natural events.
Operational threats: equipment failure, power loss, software failure, telecommunications interruption, and third-party service-provider failures.

Malware is a threat source or mechanism that can cause harm, but not every threat requires an attacker. A failed disk, utility outage, or supplier interruption can also threaten an asset.

A threat becomes a security incident when an event successfully causes an adverse impact or violates a security requirement. A suspicious email may represent a threat without being a successful incident; a stolen password used to access a system is an incident.

Attacks and exploits

An attack is an action intended to compromise, disrupt, expose, alter, or obtain an asset without authorization. An exploit is the technique, tool, or method used to take advantage of a specific vulnerability.

For example, an unpatched web server may contain a software vulnerability. An internet-based attacker is the threat actor. The attacker uses an exploit that sends specially formed requests. The resulting attack may execute unauthorized commands, alter web pages, steal data, or stop the service.

These terms describe different parts of the same chain:

A threat actor or other threat source exists.
The target contains a vulnerability or has insufficient protection.
The actor uses an exploit, when one is required.
The actor carries out an attack.
The event produces an impact if it succeeds.

A threat is broad and potential: “ransomware could affect this file server.” An attack is concrete: “a malicious attachment was opened and ransomware began encrypting files.”

The CIA triad

The CIA triad is a foundational model of three security objectives: confidentiality, integrity, and availability. It helps analysts describe what a system must protect and how an event affects it.

Security objective	What must be protected	Example of failure	Example controls
Confidentiality	Information access and disclosure, limited to authorized people, systems, and processes	A stranger downloads customer records	Least privilege, encryption, authentication, and access logging
Integrity	Accuracy, completeness, consistency, and authorized state of data and systems	An attacker changes payment details or modifies application code	Change control, checksums, digital signatures, permissions, and backups
Availability	Reliable access to information and services for authorized users when needed	A denial-of-service event or power failure stops a critical service	Redundancy, patching, capacity planning, backups, and disaster recovery

One event can affect more than one objective. Ransomware usually harms availability by encrypting files, may harm integrity by altering data, and may harm confidentiality if the operator copies the data before encryption.

Risk

Risk is the possibility and consequence of harm when a threat can exploit a vulnerability affecting an asset. Risk is not identical to a threat or vulnerability:

A threat is a potential cause of harm.
A vulnerability is a weakness that may be used or triggered.
Risk considers the likelihood and consequences of harm in a particular situation.
Impact is the consequence if an event occurs.

Practical risk analysis considers asset value, likelihood, vulnerability exposure, and impact. A simple conceptual expression is:

Risk is driven by likelihood and impact.

This is a reasoning model, not a universal calculation. Organizations may use qualitative ratings such as low, medium, and high, quantitative estimates, or combinations of both.

Common impact categories

Financial loss or recovery expense
Service interruption or lost productivity
Data exposure, theft, or privacy harm
Regulatory penalties and legal liability
Safety consequences
Reputational damage and loss of customer trust

Risk can remain after controls are implemented. This remaining exposure is often called residual risk. Security teams manage risk; they do not usually eliminate every possible failure.

Countermeasures and security controls

A countermeasure, or security control, is a safeguard used to prevent, deter, detect, respond to, or recover from security events. Controls can reduce the likelihood of an event, reduce its impact, improve detection, or support recovery.

Control categories

Administrative controls: policies, standards, risk assessments, contracts, approvals, training, and incident response procedures.
Technical controls: authentication, least-privilege permissions, firewalls, patching, encryption, endpoint protection, vulnerability scanning, and monitoring.
Physical controls: locks, access badges, guards, cameras, fences, secure server rooms, fire suppression, and backup power.

Least privilege means granting only the access needed for an approved role or task. It limits the damage that can result from a stolen account, a compromised application, or a user mistake.

Control functions

Control category	Control function	Example	Risk reduction purpose
Administrative	Preventive	A policy requiring approved access reviews	Prevents unsafe practices before an event
Technical	Detective	Centralized monitoring and alerting	Identifies suspicious activity quickly
Physical	Deterrent	Visible cameras and access badges	Discourages unauthorized activity
Technical	Corrective	Patching a vulnerable application	Removes or reduces an identified weakness
Administrative or technical	Compensating	Extra monitoring when a required legacy control cannot be used	Provides an alternative reduction in exposure
Technical or physical	Recovery	Offline tested backups and redundant power	Restores service or data after an event

Layered controls are important because one control can fail, be bypassed, or address only one part of the risk. For example, protecting a file server may require user training, email filtering, endpoint detection, network segmentation, access control, monitoring, and tested backups.

Worked examples

Customer database exposed through cloud storage

Asset: Customer records and personally identifiable information.
Vulnerability: Publicly accessible or excessively broad storage permissions.
Threat: An external attacker or data scraper.
Attack or exploit: Discovering and downloading exposed files.
CIA effect: Primarily a loss of confidentiality; integrity and availability may also matter if records are altered or deleted.
Risk: Privacy harm, regulatory consequences, fraud, and reputational damage.
Controls: Least-privilege access policies, configuration reviews, encryption, logging and alerts, and data classification.

Unpatched web server

Asset: A public web service and the data it processes.
Vulnerability: A known, unpatched software flaw.
Threat: An internet-based attacker.
Attack or exploit: Using an exploit to execute unauthorized commands.
CIA effect: Integrity and availability loss, with possible confidentiality loss.
Risk: Defacement, malware installation, service outage, or data theft.
Controls: Patch management, vulnerability scanning, a web application firewall, network segmentation, backups, and incident response procedures.

Ransomware encrypts a file server

Asset: Shared business files and the file-server service.
Vulnerability: Phishing susceptibility, weak endpoint protection, or insufficient segmentation.
Threat: A criminal ransomware operator.
Attack or exploit: A malicious attachment or link followed by malware execution.
CIA effect: Availability loss, possible integrity loss, and possible confidentiality loss if data is exfiltrated.
Risk: Operational downtime, recovery expense, and potential data disclosure.
Controls: User awareness training, email filtering, multi-factor authentication, endpoint detection and response, and offline tested backups.

Power failure interrupts a critical service

Asset: Network connectivity and critical applications.
Vulnerability: A single power source with no backup power.
Threat: A utility outage or equipment failure.
Attack or exploit: Not applicable; this is an accidental or environmental event.
CIA effect: Availability loss.
Risk: Inability to conduct business operations.
Controls: Uninterruptible power supplies, generators, redundant power feeds, and disaster recovery planning.

Common points of confusion

“The vulnerability is the attack.”

No. The vulnerability is the weakness. The attack is the action that attempts to use it. The exploit is the specific method or tool used to take advantage of the weakness.

“A threat means the system is compromised.”

No. A threat describes potential harm. Compromise requires a successful event, usually involving a feasible path through a vulnerability or insufficient protection.

“Sensitive data only needs confidentiality.”

Sensitive records also require integrity and availability. Unauthorized edits can cause financial or safety problems, and inability to retrieve records can interrupt essential operations.

“One control removes all risk.”

Controls reduce risk but do not guarantee safety. Residual risk remains, so organizations also need layered safeguards, monitoring, response planning, and recovery capabilities.

“Only hackers are threats.”

Threats also include user mistakes, equipment faults, power loss, natural events, software failures, and third-party service interruptions.

Exam-relevant summary

An asset is valuable and needs protection.
A vulnerability is a weakness, not an attack.
A threat is potential harm; a threat actor is a source capable of creating it.
An exploit uses a specific vulnerability, while an attack is the unauthorized action.
Risk combines the possibility of an event with its consequences and depends on context.
Confidentiality limits unauthorized disclosure.
Integrity protects accuracy, completeness, consistency, and authorized state.
Availability ensures authorized access when needed.
A security control can prevent, deter, detect, correct, compensate for, or help recover from security events.
Security classification and access controls should reflect asset value and the required confidentiality, integrity, and availability.