Asset, Threat, Weakness or Control?

About this interactive

What you are doing: sorting the pieces of a company's risk picture into four roles. The lesson's words: an asset is anything with value to the company, such as data, money, its reputation or its people. A threat is something that could reduce that value: the data stolen, altered or deleted. A vulnerability is a weakness a threat agent could use, like the break in the lesson's gate. A control, or countermeasure, is something put in place to lower the risk by lowering the likelihood, the impact or both: the wall, the gate, encryption, a guard, a camera. How to use it: ask what the card is. A thing worth protecting is an asset. Something that could happen to it is a threat. A gap or flaw is a vulnerability. Something added on purpose to protect is a control.

What you'll learn

Identify, in a company's own situation, which piece is an asset (something of value), a threat (something that could reduce that value), a vulnerability (a weakness a threat agent could use) and a control or countermeasure (something put in place to reduce risk)

Aligned to

CompTIA Security+

5.2 Explain elements of the risk management process.

1.1 Compare and contrast various types of security controls.

Cisco CyberOps Associate

1.3 Describe security terms

Key terms

Asset: Any resource of value to an organization, including hardware, software, data, and personnel.
Threat: Any potential event or action that could cause harm to a system, network, or organization.
Vulnerability: A weakness in a system, application, or process that can be exploited by a threat actor.
Security Control: Any safeguard or countermeasure — whether technical, physical, or administrative — implemented to protect the confidentiality, integrity, and availability of systems and data. Security controls are classified by function (preventative, detective, corrective) and type (technical, physical, administrative).
Risk: The potential for loss or harm resulting from a threat exploiting a vulnerability.
Defense-in-Depth: Defense-in-Depth is a security architecture strategy that layers multiple independent controls across technical, physical, and administrative domains so that the failure of any single control does not result in a complete security breach.

Topics

Asset Threat Vulnerability Security Control Interactive Categorize

About TechKnowSurge

TechKnowSurge builds IT and cybersecurity professionals through hands-on, concept-first training built around real understanding — not memorization. Free interactive tools, structured programs, and 25+ years of real-world experience, all in one place.

Explore free tools and programs →