![Risk Vs Threat_风险](https://s2.51cto.com/attachment/200806/200806071212806195945.jpg?x-oss-process=image/resize,m_fixed,w_1184)
no matter how large or small.
A threat includes events in which an actor engages in a behavior intended to cause a minimum loss. Any such loss must, by definition, be measurable or quantifiable.
Much later, I realized that this experience represented my first professional exposure to a conflict and understood how it shaped my career. At the time, I worried about the technical and procedural aspects of resolving the "security need." Later, I explored the ramifications of a proper security procedure. Eventually, I saw the basic conflict at the heart of the issue: the determination of risk rather than threat.
We feel threatened. Threat appears as we move though our lives. We pick up these feelings from news, from thinking about problems that might arise, and even from talking to other people. As human beings, we use whatever means is at our disposal to deal with threats.
We also assess risk. In order to do so, we must first define the threats that loom around us. We then come to grips with their probability and potential impact. Based on this assessment, we then formulate strategies (procedural or technical) to deal with them.
Risks have two basic values: probability and potential impact. These values combine to create the risk's severity, the reasoned measure of how much danger a risk presents. Probability measures the likelihood of the risk's occurrence throughout the life of the project. I personally use a percentage chance; other consultants I know prefer to measure probability in terms of likelihood-per-given-day (i.e., strict probability based on a logarithmic scale). Potential impact measures the damage a risk inflicts should it occur. As with priority, we generally concern ourselves with actual dollar impacts rather than secondary effects.