which option is the term for a weakness in a system or its design that can be explited by a threat