1. What is the difference between a threat agent and a threat?
Threat agent is the specific instance or a component of a threat. For example, the threat of “trespass or espionage” is a category of potential danger to information assets, while “external professional hacker” (like Kevin Mitnick, who was convicted of hacking into phone systems) is a specific threat agent. A lightning strike, hailstorm, or tornado is a threat agent that is part of the threat known as “acts of God/acts of nature.
A threat is a category of objects, people, or other entities that represents a danger to an asset. Threats are always present and can be purposeful or undirected. For example, hackers purposefully threaten unprotected information systems, while severe storms incidentally threaten buildings and their contents.

2. What is the difference between vulnerability and exposure?
Vulnerability A weakness or fault in a system or protection mechanism that opens it to attack or damage. Some examples of vulnerabilities are a flaw in a software package, an unprotected system port, and an unlocked door. Some well-known vulnerabilities have been examined, documented, and published; others remain latent (or undiscovered).
Exposure A condition or state of being exposed; in information security, exposure exists when vulnerability is known to an attacker.

3. How is infrastructure protection (assuring the security of utility services) related to information security?
Information security is the protection of information and it is critical elements, including the systems and hardware that used, store, and transmit that information, Thus, assuring the security of utility services are critical elements in information system.

4. What type of security was dominant in the early years of computing?
Early security was entirely physical security.

5. What are the three components of the