Given a situation where a system has SSL 3.0 and TLS 1.0 enabled would the following mapping be accurate:
Weakness/vulnerability: The remote service accepts connections encrypted using TLS 1.0 and SSL 3.0.
Threat: An attacker can exploit these flaws to conduct man-in-the-middle attacks or to decrypt communications between the affected service and clients
Risk = Threat × Vulnerability: So in the above case, we would calculate risk by looking at the probability that an attacker can exploit flaws in the TLS 1.0 and SSL 3.0 protocols?
Are my assumptions correct?