A risk is the likelihood that something bad will happen to an asset. • A threat is any action that could damage an asset.

• A vulnerability is a weakness that allows a threat to be realized or to have an effect on an asset.

• Gramm-Leach-Bliley Act (GBLA) – Passed in 1999, the GBLA requires all types of financial institutions to protect customers’ private financial information.

• Protecting private data is the process of ensuring data confidentiality. Organizations must use proper security controls specific to this concern. An example is:

o Adopting a data classification standard that defines how to treat data throughout your IT infrastructure. This is the road map for identifying what controls are needed to keep data safe.

• Standard – A standard is a detailed written definition for hardware and software and how it is to be used. Standards ensure that consistent security controls are used throughout the IT system.

• Data Classification Standards:

o Private Data – Data about people that must be kept private. Organizations must use proper security controls to be in compliance.

o Confidential – Information or data that is owned by the organization. Intellectual property, customer lists, pricing information, and patents are examples of confidential data.

o Internal Use Only – Information or data shared internally by an organization. While confidential information or data may not be included, communications are not intended to leave the organization.

o Public Domain Data – Information or data shared with the public such as web site content, white papers, etc.

• Federal Government Data Classification Standards:

o Top Secret – Applies to information that the classifying authority finds would cause grave damage to national security if it were disclosed.

o Secret – Applies to