Threats vs. Vulnerabilities 51
Schneier's blog links to a short paper on the difference between threats and vulnerabilities. It's a little heavy for this early in the morning, but it might be worth your time.
Variables don't; constants aren't.
Summary (Score:5, Interesting)
Difference between "threats" and "vunlerabilities"
THREAT: A Criminal might break into my house
Vulnerability: My house has no lock.
He then goes on to talk about how using Threat Analysis tools is Not sufficient to identify vulnerabilities, because they are not the same thing, and Vulnerabilities are much more difficult to identify.