How is an “attack” represented?

An attack is an action that actualizes a threat by exploiting a vulnerability. It is best represented by three core components: a motive (the attacker's goal or reason), a method (the technique or tool used), and a vulnerability (the weakness in the target that the method exploits). The absence of any of these components makes the description of an attack incomplete. For instance, a method is useless without a vulnerability to exploit, and an action without a motive is not a targeted attack.

A. This is incomplete as it lacks the vulnerability, which is the specific weakness that the attacker's method exploits.
C. This formula, often expressed as Risk = Asset x Threat x Vulnerability, is used to define and calculate risk, not the attack itself.
D. This is incomplete. A threat actor may exist and target an asset, but without a vulnerability, no attack can occur.

1. Pfleeger, C. P., Pfleeger, S. L., & Margulies, J. (2015). Security in Computing (5th ed.). Prentice Hall. Chapter 1, Section 1.3, "Threats, Controls, and Attacks," describes an attack as requiring a method, opportunity (vulnerability), and motive.

2. National Institute of Standards and Technology (NIST). (2012). Guide for Conducting Risk Assessments (NIST SP 800-30 Rev. 1). https://doi.org/10.6028/NIST.SP.800-30r1. Section 2.2.3, "Threat Events," implicitly links threats, vulnerabilities, and predisposing conditions to adverse impacts, where the attack is the event itself.