In IT security terms it is important to be able to distinguish between the three core concepts: threat, vulnerability, and risk. In order to ensure consistency the NIST has defined each concept. Which of the following is the NIST definition of a risk?"
1. The likelihood and impact (or consequence) of a threat source exercising a vulnerability
2. A system or procedure put in place without any relevant precautions
3. A weakness that could be triggered accidently or exploited intentionally to cause a security breach
4. The potential for a threat source to exercise a vulnerability