Lesson 2 — Requirements, Classification, Vulnerability, Threat & Risk
Classify before you control
An organization cannot consistently protect sensitive data if it does not know what the data is, where it lives, and which restrictions apply.
The enterprise data model and Metadata matter because security classifications have to connect to real tables, columns, files, reports, feeds, interfaces, and copies. A CUSTOMER table labeled confidential is not enough if the same email address appears in exports, test databases, spreadsheets, a data lake, and vendor feeds.
Security Metadata can standardize classifications so common rules drive access, masking, encryption, monitoring, and handling across systems.
Exposure principle
Reduce risk by reducing exposure. The easiest confidential copy to protect is the copy that was never unnecessarily created. Non-production proliferation creates more access paths, retention obligations, monitoring needs, and breach opportunities.
Vulnerability, Threat, Risk — do not use them as synonyms
Vulnerability
A weakness or defect that permits compromise.
Examples: unpatched server, default password, insecure process, exposed test system.
Threat
A potential adverse/offensive action or event that could exploit a vulnerability. It may be internal or external, deliberate or accidental.
Risk
The evaluated possibility/condition of loss after considering likelihood/frequency and consequences. Chapter 7 discusses factors such as amount/type of damage, revenue/operational effect, repair cost, prevention cost, and attacker intent.
One chain
- Vulnerability: a vendor account still uses a default password.
- Threat: an attacker tries known default credentials.
- Risk: successful access could expose regulated customer data, interrupt operations, create fines, and require remediation.
The response changes by layer: fix the weakness; detect/block threats; prioritize controls according to assessed risk.
Risk classification is not confidentiality classification
DMBOK gives Critical Risk Data (CRD), High Risk Data (HRD), and Moderate Risk Data (MRD) as example risk classifications for sensitivity/attractiveness to misuse. These are not automatically the same as confidentiality labels or regulatory categories.
Risk prioritization should involve stakeholders: the business understands operational impact, legal/compliance understands obligations, and security understands exploitability/control options.
Exam discriminator
- weakness → Vulnerability
- possible adverse action → Threat
- likelihood + impact/cost → Risk
Source anchor: pp. 212–216.