In web analytics, source is where (website, newsletter, search engine, email, etc.) your visitors came from, while medium is how (paid, referral, search, direct) – they arrived.
If a source is not known, it will be listed as “direct” which usually means the visitor typed your website address into their browser, but can include bookmarks or even a document they have downloaded and clicked a link in if tracking has not been set up.