Which statement best defines a vulnerability?

• A. A weakness in an information system, system security procedures, internal controls, or implementation that could be exploited are triggered by a threat source.
• B. A threat source.
• C. A security policy.
• D. A encryption algorithm.

Answer: (A)

A vulnerability is a weakness in an information system, system security procedures, internal controls, or the way a system is implemented that could be exploited by a threat source. This captures the idea that the weakness exists in the environment or processes, and it becomes problematic only when someone or something with malicious intent (the threat source) could use that flaw to cause harm. The concept distinguishes the weakness from the attacker (threat source), which is the actor that might take advantage of the weakness. A security policy is simply a set of rules guiding how security should be handled, not a weakness itself. An encryption algorithm is a cryptographic method used to protect data, not a flaw in the system.