Combining Threat, Vulnerability, and Countermeasure
Risk arises when a threat exploits a vulnerability. A threat alone, or a vulnerability alone, does not become a risk by itself — risk arises from the combination of the two, and applying a countermeasure matched to that combination lowers the risk.
GOAL
Explain how risk arises from a combination of a threat and a vulnerability, and that each combination has its own countermeasure.
Against the threat of unauthorized login, with the vulnerability of a weak password, what is the countermeasure?