How are we supposed to evaluate potential security threats among the 7 (typical) domains of an IT infrastructure?

The amount of potential threats is non-finite. The whole method of managing risk in information security seems ridiculous. Is there something I am missing?