Emerging Risk and the Threat Landscape

CISM aspirants should be able to establish the difference between a threat and a vulnerability. A vulnerability means a weakness in the system. A threat is any element that attempts to exploit the vulnerability. For example, when an anti-virus is not updated, it is considered a vulnerability. A hacker who attempts to exploit this vulnerability is a threat. It is the objective of an internal control to reduce vulnerability. Internal controls cannot directly control threats.

Emerging Threats

An information security manager must be aware of the constantly evolving threat landscape and how it affects their organization. As infrastructures evolve, new risks can emerge in unexpected ways. When a threat is combined with a lack of adequate monitoring, a breach might occur.

Unusual activity on a system, frequent alarms, delayed system or network performance, or new or excessive activity in logs are all signs of emerging threats. Many affected...