Most Common Cyber Threats

Discussion of the most common cyber threats usually blends three separate ideas, and a risk register built on the blend cannot be sorted or acted on.

A threat is what could cause harm. A criminal group, a careless employee, a failing supplier.

A vulnerability is the weakness they could use. Unpatched software, a shared password, no verification step before paying an invoice.

A risk is the combination, expressed as likelihood and consequence for your organisation specifically.

The distinction is practical rather than academic. You cannot remove threats from the world. You can close vulnerabilities, and that is where all of the useful work goes.

A register listing threats without the matching vulnerabilities gives you nothing anybody can be assigned, and nothing that can be closed off.

The Australian Cyber Security Centre publishes guidance for organisations. This is general information rather than legal advice, and obligations vary by state and territory.

See Sentrient’s risk management system and cyber security training course.