How do you assess the difference between a cyber threat, vulnerability, and risk?
When assessing a threat, vulnerability, and risk, there are several factors to consider. Let's take a deeper dive into what these are and how to be prepared to answer questions that come up in an interview. In simple terms, a threat refers to a circumstance or event with the potential to cause harm by way of an outcome. One example could be a phishing attack that allows the attacker access to steal private or confidential information for personal gain. Vulnerability simply means a weakness in a system. One example is an attacker planting a cross-site script to gain control over sensitive data within a network infrastructure. Lastly, in this case, a threat is defined as a threat probability followed by potential loss. It is important to note that a hiring manager might ask a combined question or a singular question. This means they may just ask about vulnerability or just a threat question to move the interview along. It's best to be prepared for all three questions anyway. The hiring manager is looking to achieve a couple of things here. They want to see how well you can articulate all three definitions (provided they ask all three questions) and how deep your understanding is within these three areas.
"When I perform a threat, vulnerability, and risk assessment, there are certain protocols and procedures I must follow. I first need to identify whether I'm dealing with a threat, vulnerability, or mitigating risk. Identifying vulnerability is very important because this will reveal to me how well our detection and intrusion systems are working, and whether or not they are leaving us vulnerable to attacks at any level of our networks and systems. If we find that there are widely exploited vulnerabilities that come to my attention, I immediately act to secure those areas of vulnerability. During my tenure here, I was able to maintain a safe and secure technology environment by standardizing encryption, detection, and authorization practices."
"If I'm dealing with a threat, I need to identify who the threat actor is (a person or entity who initiates a threat), then I know how to respond to this threat. I go through a checklist of items to make sure that we have secured our networks, systems, and users. This can be achieved by software monitoring systems that alert us to threat traffic, and how they might be attempting to breach our systems. In cases where I am addressing risks, I take a proactive approach to mitigating risks by monitoring and scanning our architecture to see if there are any SQL injections or Cross-site scripts present. I run these automated tests on a daily basis to safeguard our systems."
The best approach to responding to this question is to define each issue the interviewer asks you about. You can then begin to compare and contrast them, noting the differences between each of them and how you would prepare or respond to these. You may want to provide the interview with examples of a cyber threat, vulnerability, and risk that you've encountered in your previous positions and how you dealt with each of these. If the interviewer asks a follow-up question about any of these topics, it indicates they have a special interest and may have already encountered them or are anticipating they will.
