Front cover - IBM Redbooks

2.1 Approaches to IT security
44 Lotus Security Handbook
Before we can delve into the methodologies, it’s important to understand what
lies at their core (that is, the principles, goals, and objectives of IT security).
2.1.1 Some definitions
In addition to the definitions provided in the previous chapter, more terminology
must be clearly understood before the reader can fully appreciate the material in
this chapter.
In particular, the distinction between a threat and a risk must be clearly identified.
In short, threats generate risks, which need to be mitigated. The degree to which
these risks can be mitigated depends on a lot of factors. All this is covered in due
time, but first, let’s consider our definitions.
Threat
The word threat takes its root from the Old English work thrat, which means
oppression. There are three modern definitions for the word:
1. An expression of an intention to inflict pain, injury, evil, or punishment.
2. An indication of impending danger or harm.
3. One that is regarded as a possible danger; a menace.
For the purposes of this redbook, and in the context of the methodologies that we
cover, we retain the last definition: a threat is basically a possible danger or
harm, in one word, a menace.
Risk
The word risk has a number of definitions, not all of which apply because of the
context in which we use the word. Here are the modern-day definitions that apply
to the purposes of this chapter:
1. The possibility of suffering harm or loss; danger.
2. A factor, thing, element, or course involving uncertain danger; a hazard, as in:
“the usual risks of the desert: rattlesnakes, the heat, and lack of water” (Frank
Clancy).
3. To expose to a chance of loss or damage; to incur the danger of, as in: “His
action risked a sharp reprisal.”
Add to that the idiom, at risk, which has this definition:
► In an endangered state, especially from lack of proper care, as in:
“unsupervised children who are at risk of dropping out of school”