evsjv‡`k †M‡RU, AwZwi³, GwcÖj 6, 2014 12561 (b) Threat A threat is a potential cause of an unwanted incident, which may result in harm to a system or organizations’ information assets. Threat is anything that can exploit vulnerability, intentionally or accidentally, and causes damage, or destruction of an asset. Threats can occur by natural disaster, intentional or accidental acts originating from inside or outside the agency. Most threats exploit vulnerabilities in information assets or their supporting infrastructure (hardware or software). Typical information security threats that could cause unwanted event include: a. unauthorized access, b. disclosure of information, c. legal threats, d. sabotage, e. inadequate security awareness, f. poor security policy, g. fraudulence, h. workload, i. denial of service, j. spoofing, k. advanced persistent threat (APT), l. applications with bugs, m. eavesdropping, n. identity, o. DNS security threat etc. (c) Vulnerabilities Vulnerabilities are flaws or weaknesses associated with an agency’s assets or capabilities. Vulnerability is merely a condition or set of conditions that may allow a threat to affect an asset. Therefore, a vulnerability that cannot be exploited by a threat cannot be a security risk. Typically vulnerability results from: a. flawed procedures, b. under-skilled staff, c. incorrectly configured or defective technology.