7 hours 52 minutes
Lesson 4.3 Identification off threats
In this lesson,
we'll cover what traits are,
and we'll go over a few examples of threats.
So what are threats?
These can be man made,
intentional or accidental,
natural or environmental in nature.
Threats are a specific type of event or action performed that could result in damage to assets.
For most threats to occur, there would also need to be a vulnerability present, which we will discuss in the next section.
One of the easiest ways to come up with threads is search for some free guides online with the most common ones
I sold, 27,000 and five gives a table of some of the most common threats.
The most important thing to do during your threat identification is to list all possible threats that could happen to your organization,
regardless of any controls that may or may not already exist.
You want to be as open minded as possible to ensure you go through as many possible adverse scenarios as you can.
But, for example,
if your organization is in a desert and the threat list that you're working off suggests blizzard or ice or snow storm as a potential threat
that probably doesn't need to go on your threat list, given the environment that you are based in.
But something like fire is always a threat, even if you have controls in place
and should always form a part of the threat list. Regardless of its current likelihood,
you want to be able to assess where you currently stand against these streets and accurately determined your key areas of weakness and likelihood for risk to materialize.
With regards to human threats,
it is useful to put them into buckets of threat actors.
These buckets can include groups like hackers,
nation states, terrorists, disgruntled employees, activists, etcetera.
It's a largely to assess each of these types of actors in terms of their motivation,
to get your organisation's assets
as well as the capability of the great actors.
You should obviously keep the ones that are both very capable and motivated at the top of mind for the next steps in the risk management process.
There are multiple threat modern methodologies out there, so choose best one that works for your organization.
So as we mentioned briefly on the previous slide,
here are some of the common threat actor bucket groups
having a list to start off with and make the process easier to think off other potential threat actors, which are unique to your organization.
For each of these buckets,
we need to look at the capability as well as the motivation off these threat actors in relation to your organization.
If you're a corner store bakery, a terrorist organization is probably not going to be very motivated to target you.
But if you're a government department or even a critical infrastructure organization to your country,
you'd probably be a lot higher on the target list for a terrorist group.
Capability Off a Thread actor is how technically capable they are to gain access to information and sits,
especially those stored and transmitted in Elektronik formats.
A criminal syndicate, for example, would typically be very capable, as they often have large financial backing for their operations, and they are able to recruit very skilled hackers.
A general user, on the other hand, is probably not as technical,
especially with regards to advanced hacking techniques.
Motivation is where you determine or estimate how motivated an attacker would be to try and get your information.
In other words, How badly do they want it?
The easiest is to assess
capability and motivation on a scale of 1 to 5.
There are resource is available online
to help you give definition
to what each of these levels meaning.
Basically, level five is the most capable and most highly motivated,
while Level one would be the least capable and least motivated.
Multiplying your motivation, by your capability
would give you the overall level off threat.
Putting this in the Matrix would allow you to plot these levels in terms off critical, very high medium low,
an insignificant, for example,
In this lesson, we covered what the threats are
and why they need to be considered during risk management.
We looked at examples of different types of threats and threat actors.
We also discussed capability and motivation and how this needs to be factored into your considerations. Iran Specific Threat Actors