2. What is a
risk, and what is vulnerability?

Risk and vulnerability assessment helps to identify people,
property, and resources that are at risk of injury, damage, or loss from a
number of negative occurences; such as hazards, incidents, sabotage, natural
disasters, human error, equipment error, etc. To reduce the risk that a
negative event will occur within a system or an organization is to
quantitatively reduce the chance by assessing for any or all that could go
wrong. This information is important to help determine and prioritize the
precautionary measures that can make any system or organization more
disaster-resistant. Risk is the chance that it will happen, and vulnerability
is the weakness that might cause it to occur. Therefore, you assess to
determine the vulnerability and reduce the risk, which makes your organization
stronger and more disaster-resistant.

Norman, T. L. (2010). Risk analysis and Security
Countermeasure Selection. Boca Raton, FL