Cyber Strategy Management – 1D. Review threat landscape (3/5)

Assess threat sources

Threat sources are anything that can cause harm to your information assets. To effectively manage risk, it is crucial to identify and understand the characteristics of threat sources relevant to your organization.

This understanding will help you identify later potential threat events that threat sources can initiate, assess their likelihood of initiation and gauge their inherent impact.

As an outcome of this activity, you should produce a list of threat sources relevant to your organization with ratings of two key parameters – threat source probability and threat source strength, which we will explain later in this article.

Create a table for threat sources

To organize information about threat sources, construct a table with the following columns:

Identify threat sources

To identify threat sources, you can leverage resources available within your organization or use taxonomies provided in the following standards:

NIST SP 800-30. Appendix D to NIST SP 800-30 offers a threat source taxonomy, including adversarial, accidental, structural and environmental categories, their description and attributes that you can assess.

IRAM2. Appendix C to IRAM2 includes a common threat list grouped by adversarial, accidental and environmental categories. It covers the threat source and its origin, which can be internal or external.

ISO 27005. Annex C to ISO 27005 presents examples of typical threats. However, this list is limited and mixes threat sources with threat events.

Market reports. Market reports collected during the “Identify information sources” activity should supply you with the latest insights into existing and emerging threat sources.

NIST, ISF and ISO categorize the threat sources based on their intent. While the naming conventions or the number of categories may vary slightly, they serve as a foundation for defining threat source characteristics:

Adversarial. Individuals, groups, organizations, or states with deliberate intentions to exploit or damage your information resources.

Accidental. Sources responsible for erroneous or unintentional actions that may negatively impact information assets.

Environmental. Natural disasters, man-made hazards, and failures of critical infrastructure, all of which are beyond your organization’s control.

Structural. Failures in equipment, software, or environmental control that could affect supporting applications for information assets.

By reviewing available resources, you can construct an initial list of threat sources, including threat source category, title, and origin.

Then, you can assess their relevance to your organization, considering your business model, your industry, and various factors such as political, economic, regulatory, social, technological, and other that impact your organization.

Assess threat source probability

Threat source probability is the likelihood that a particular threat will act against your assets by initiating one or more threat events. Various risk management frameworks employ this parameter (e.g., Threat Event Frequency in FAIR, Likelihood of Initiation in IRAM2, and Likelihood of an Attack Initiation in NIST).

To assess threat source probability, evaluate the characteristics summarized below.
The table includes the most often used attributes, their description, applicability based on threat category and reference to frameworks that use these attributes and will provide you with more details:

IRAM2 proposes a complete approach to evaluate the combination of selected attributes and a set of Threat Profiling Reference Tables that define each attribute, a question you need to ask to assess the attribute level and comprehensive additional guidelines. NIST provides qualitative ratings related to their attributes as well.

If you need a simple approach, estimate the level of each attribute. Generally, the higher level each attribute has, the higher the threat source probability. For an adversarial threat source, the more events it initiated in the past (History) and the higher Motivation, the higher the threat source probability will be.

It is important to note that if you have data and are considering the history of events, your rating scale should correspond to a number or range of events within a defined period.

In addition to this, for adversarial threat sources, you have the option to assess and list their intents. It allows for predicting the types of potential threat events they might initiate. A nation-state actor, for example, might pursue objectives like political or economic gains, different from a cybercriminal group that primarily aims for financial profit. Their possible intents could range from financial gains, espionage, disruption, reputation damage, competitive advantage, political influence, cyber warfare, ideological or religious beliefs, personal vendetta, and exploration to simple curiosity. However, motivations can be tricky to determine and might only become apparent following a thorough investigation.

After considering the above attributes, assign a qualitative rating to each threat. This rating describes the threat source probability, for example, 1 – Very Low, 2 – Low, 3 – Medium, 4 – High, and 5 – Very High.

Assess threat source strength

IRAM2 defines Threat Strength as “how effectively a particular threat can initiate and/or execute threat events” against your environment. This parameter helps to prioritize threat sources, assess the likelihood of a successful threat event and derive a residual business impact rating. FAIR has a similar concept called Threat Capability, defined as “the capability of a threat agent.”

In this article, I use a threat source strength name as this is related to the threat source. I also use this parameter to prioritize threat sources when conducting a strategic threat landscape assessment to keep things simple.

To evaluate threat source strength, consider the characteristics outlined below. The table includes frequently used attributes, their descriptions, applicability based on threat category, and references to frameworks that employ these attributes for further details:

Similar to the assessment of threat source probability, after considering the factors specified above, assign a qualitative rating to each of your threat sources to describe their threat source strength. For example, 1 – Very Low, – Low, 3 – Medium, 4 – High, 5 – Very High.

Assess threat source criticality

Once you have determined your ratings related to threat source probability and threat source strength, you can evaluate threat source criticality to identify which threats to prioritize for further analysis. When assessing the threat landscape at a strategic level, considering all threat sources may not be feasible, as this could be too time-consuming and not necessarily valuable.

One approach recommended by IRAM2 is to sort the threat sources first by their likelihood of initiation and then by their strength. The next step would be to sequentially number the list, establishing the threat source priority for further analysis.

However, if you are concerned about overlooking threat sources that seldom initiate attacks against your organization but possess greater strength, you can adopt an alternative approach.

You can multiply threat source probability and threat source strength numeric values to calculate the threat source criticality. Use this value to rank your threat sources in descending order. The higher the threat source criticality, the higher the priority it should have in your analysis.

As shown in the following example, you can also represent it by a simple matrix that considers both ratings. The most critical threats are in the top right section of the matrix.

As a result of this activity, you should end up with a list of your threat sources ordered by threat source criticality, starting with those with the highest values.