Title: Analyze threats and vulnerabilities in information systems.
Course: Cybersecurity in Family and Consumer Sciences, Advanced (19299-II) > Section: Examining Cyber Threats and Vulnerabilities

Analysis should include concepts such as

- asset (as it relates to a secure environment)—a person, structure, facility, information and records, information technology systems and resources, material, process, relationships, or reputation that has value
- vulnerability—a characteristic or specific weakness that renders an organization or asset (such as information or an information system) open to exploitation by a given threat or susceptible to a given hazard
- exploit—a technique to breach the security of a network or information system in violation of security policy
- threat—a circumstance or event that has or indicates the potential to exploit vulnerabilities and to adversely affect (create adverse consequences for) organizational operations, organizational assets (including information and information systems), individuals, other organizations, or society
- attack vector—a path or route used by the adversary to gain access to the target (asset)
- threat agents—an individual, group, organization, or government that conducts or has the intent to conduct detrimental activities
- safeguards—a practice, procedure, or mechanism that reduces risk.

Process/Skill Questions:

Thinking

- What is an asset in a secure environment?
- What is an attack vector?

Communication

- What information should be communicated to stakeholders (members, public) when a cyber threat has been identified?
- What are communication consequences if individuals do not understand cybersecurity threat and vulnerability issues and terms?

Leadership

- How can leaders guide others to identify and analyze threat actors?
- How can leaders support others in learning more about threat actors?

Management

- What consequences may result if a person is not alert to the presence of cyber threats?

Teacher Resources:

- National Initiative for Cybersecurity Careers and Studies (NICCS)
- United States Computer Emergency Readiness Team (US-CERT)