Inherent and Residual Risk: How Both Scores Drive Enterprise Risk Decisions | Optiv
A commonly accepted definition of risk is: “The likelihood that a threat (or a threat agent) will exploit a given vulnerability, multiplied by the business impact of that exploit.” In information security, threats are typically broken down into the three categories of natural, facility or human, and the impacts are assessed against the confidentiality, integrity and availability of information assets.
