of America defined vulnerability in CNSS Instruction No. 4009 dated 26 April 2010 National Information Assurance Glossary: Vulnerability—Weakness in an information system, system security procedures, internal controls, or implementation that could be exploited by a threat source. Many NIST publications define vulnerability in IT context in different publications: FISMApedia term provide a list. Between them SP 800-30, give a broader one: A flaw or weakness in system security procedures, design, implementation, or internal controls that could be exercised (accidentally triggered or intentionally exploited) and result in a security breach or a violation of the system's security policy. ENISA defines vulnerability in as: The existence of a weakness, design, or implementation error that can lead to an unexpected, undesirable event [G.11] compromising the security of the computer system, network, application, or protocol involved.(ITSEC) The Open Group defines vulnerability in as The probability that threat capability exceeds the ability to resist the threat. Factor Analysis of Information Risk (FAIR) defines vulnerability as: The probability that an asset will be unable to resist the actions of a threat agent According to FAIR vulnerability is related to Control Strength, i.e. the strength of control as compared to a standard measure of force and the threat Capabilities, i.e. the probable level of force that a threat agent is capable of applying against an asset. ISACA defines vulnerability in Risk It framework as: A weakness in design, implementation, operation or internal control Data and Computer Security: Dictionary of standards concepts and terms, authors Dennis Longley and Michael Shain, Stockton Press, , defines vulnerability as: 1) In computer security, a weakness in automated systems security procedures, administrative controls, Internet controls, etc., that could be exploited by a threat to gain unauthorized access to information or to disrupt critical processing. 2) In computer security, a weakness in the physical layout, organization, procedures, personnel, management, administration, hardware or software that may be exploited to cause harm to the ADP system or activity. 3) In computer security, any weakness or flaw existing in a system. The attack or harmful event, or the opportunity available to a threat agent to mount that attack. Matt Bishop and Dave Bailey give the following definition of computer vulnerability: A computer system is composed of states describing the current configuration of the entities that make up the computer system. The system computes through the application of state transitions that change the state of the system.