Certified: The CISSP Prepcast

Welcome to The Bare Metal Cyber CISSP Prepcast. This series helps you prepare for the ISC squared CISSP exam with focused explanations and practical context.
In this episode, we are examining one of the most foundational areas of cybersecurity—risk management. More specifically, we will focus on three core concepts: threats, vulnerabilities, and risk itself. These terms form the basis of everything from security architecture and control selection to compliance programs and business continuity planning. Understanding the relationships between threats, vulnerabilities, and risk helps you prioritize your work, allocate resources effectively, and make better decisions about protecting assets in a constantly changing threat landscape.
Let us begin with threats. A threat is any potential cause of harm to an organization, system, or information asset. Threats do not have to be active or imminent to be real. They simply need to exist as a source of possible damage. Think of a threat as the danger or negative force in the equation—it is the actor, event, or condition that could disrupt or destroy something you are trying to protect.
Threats come in many forms. Some originate from external actors, such as cybercriminals, hacktivists, or nation-state adversaries. Others are environmental, like hurricanes, fires, or power outages. There are also internal threats, including disgruntled employees, negligent contractors, or unintentional user errors. In today’s hyper-connected environment, even your vendors and supply chain partners can become threat vectors if their systems are compromised.
Examples of common threats include phishing attacks, which attempt to deceive users into sharing sensitive information; malware infections that corrupt, delete, or exfiltrate data; denial-of-service attacks that disrupt operations; insider misuse of access privileges; and natural disasters that destroy physical infrastructure or interrupt network availability. Even well-meaning employees can become threats if they lack proper training or are allowed to bypass security controls.
Identifying threats requires a combination of proactive tools and strategic thinking. Threat intelligence, for example, provides insights into current attack trends, common attacker tactics, and industry-specific risks. Monitoring systems detect anomalies and alert security teams to suspicious behavior. Awareness programs help staff recognize social engineering tactics and report unusual activity. No matter how advanced your technology is, you will always need human awareness and strategic insight to truly understand and prepare for the threats your organization faces.
Now that we understand threats, let us move to vulnerabilities. A vulnerability is a weakness in a system, process, or environment that could be exploited by a threat. If a threat is the danger, then a vulnerability is the open door or the weak spot that lets the danger in. Without vulnerabilities, threats have no way to cause harm. This is why managing vulnerabilities is such a critical part of cybersecurity.
Vulnerabilities can be technical, such as unpatched software, outdated operating systems, or default credentials that have not been changed. They can also be procedural, such as poor password policies, lack of segregation of duties, or failure to follow secure coding practices. Human factors are a major source of vulnerability as well—insufficient training, social engineering susceptibility, or lack of security awareness all create risk.
To detect and manage vulnerabilities, organizations perform vulnerability assessments. These are systematic reviews of systems, networks, and applications to identify weaknesses. Some organizations also conduct penetration testing, where authorized testers simulate attacks to uncover vulnerabilities that might be missed through automated scanning. The results of these tests help prioritize remediation efforts and strengthen the overall security posture.
Vulnerability management is not a one-time task. It is an ongoing process that includes identifying vulnerabilities, evaluating their severity, applying patches, and verifying that controls remain effective. It also includes developing compensating controls for risks that cannot be completely eliminated. The faster and more accurately you can identify and address vulnerabilities, the more you reduce the potential for threats to become successful attacks.
Now let us put these concepts together and talk about risk. Risk is the potential for loss, damage, or disruption resulting from a threat exploiting a vulnerability. It is a combination of two key factors—the likelihood that a threat will take advantage of a vulnerability, and the impact that event would have on the organization. Risk is not just theoretical—it has real consequences in terms of cost, downtime, legal liability, and reputation damage.
There are two main ways to assess risk—quantitatively and qualitatively. A quantitative risk assessment assigns numerical values to likelihood and impact. For example, you might say there is a twenty percent chance of a ransomware attack that would cost five hundred thousand dollars in recovery and lost revenue. This allows you to calculate a numeric risk exposure value. A qualitative assessment, on the other hand, ranks risks based on categories such as low, medium, or high. This approach is easier to implement and understand, especially when precise data is unavailable.
Both methods have value, and many organizations use a hybrid approach. What matters most is that risk assessments are performed consistently and based on realistic assumptions. You must also consider your organization’s risk tolerance. Risk tolerance is the amount and type of risk the organization is willing to accept in pursuit of its objectives. This varies by industry, size, and culture. A hospital may have very low risk tolerance for data loss, while a tech startup may accept higher risk in exchange for agility and speed.
Managing risk means making choices about where to focus your energy. It means investing more in high-risk areas, accepting low-risk situations when necessary, and preparing to respond quickly when things go wrong. It is a balance between proactive prevention and practical readiness.
For more cyber related content and books, please check out cyber author dot me. Also, there are other podcasts on Cybersecurity and more at Bare Metal Cyber dot com.
Let us now walk through the standard risk management process. There are four main steps: identification, assessment, mitigation, and ongoing monitoring.
The first step is identification. You need to identify the assets that matter most to the organization and the threats and vulnerabilities associated with them. This step involves asset inventories, threat modeling, and vulnerability scanning. The goal is to create a clear picture of what could go wrong.
Next comes assessment. This is where you analyze each identified risk to determine its likelihood and impact. You might use historical data, expert judgment, or modeling tools to assess severity. This step helps prioritize which risks need immediate attention and which can be addressed over time.
The third step is mitigation. This involves implementing security controls, policy improvements, or changes in procedure to reduce either the likelihood or the impact of a given risk. Examples include firewalls to block external threats, encryption to protect data in transit, or access controls to limit who can change system configurations.
The final step is ongoing monitoring. Risks change over time. New threats emerge. Systems are updated. Staff come and go. Continuous monitoring ensures that your controls remain effective and that new vulnerabilities are detected quickly. Periodic re-assessment helps verify that your risk management strategy remains aligned with business needs.
Risk management should not happen in isolation. It needs to be embedded into the organization’s overall strategy. When risk management is aligned with business objectives, it receives the attention, support, and funding it needs to be effective. It also becomes a driver of value rather than just a cost center.
Senior leadership involvement is crucial. When executives understand risk and support the security team’s work, the organization is more likely to make smart decisions about budgets, staffing, and technology. Risk management is not just about saying no to risky ideas. It is about enabling innovation and growth while keeping exposure within acceptable limits.
Cross-departmental cooperation is also important. Risk is not just a technology issue. It affects finance, legal, operations, human resources, and more. For example, a new marketing platform may require security input to assess third-party data handling. A new hiring system may need access controls and privacy reviews. The more departments work together, the better the outcomes.
Documenting the risk management process is equally important. When decisions are recorded, it creates transparency and accountability. It also makes it easier to improve over time. You can review what worked, what did not, and why certain decisions were made. This documentation is helpful for audits, regulatory compliance, and knowledge sharing.
Ultimately, effective risk management must become part of the organization’s culture. People at all levels should understand that their actions influence risk. Security teams must educate, guide, and support others so that risk-aware behavior becomes the norm. From system administrators to customer service agents, everyone has a role to play in identifying and managing risk.
Thank you for tuning into the CISSP Prepcast by Bare Metal Cyber. Visit baremetalcyber.com for additional episodes, extensive study tools, and personalized CISSP certification guidance. Keep assessing threats, mitigating vulnerabilities, and managing risks proactively—and we'll guide you every step of the way toward CISSP success.