How risks are identified
Asset
The data, system or process you protect
+
Vulnerability
An exploitable weakness
+
Threat
Who or what exploits it