Cyber Strategy Management – 1D. Review threat landscape (4/5)

Assess threat events

A threat event refers to an event or situation initiated by a threat source, which may lead to undesirable consequences for your information assets. It is important to note that a single threat source can start multiple threat events, and similarly, a single threat event could be triggered by various threat sources.

After completing the steps described below, you should have a comprehensive list of threat events that could affect your information assets. This list will assist you in prioritizing your cybersecurity domains.

Create a table for threat events

To manage your threat events, create a table labeled Threat Events. This table should include the following columns to consolidate information about threat events, threat sources, and other attributes for calculating inherent risk ratings:

Identify potential threat events

Several standards provide catalogs of threat events:

NIST 800-30. Appendix E of NIST 800-30 provides examples of adversarial and non-adversarial threat events and their descriptions. The adversarial threats are presented following a kill-chain model and are arranged based on the threat source capability.

IRAM2. It includes adversarial, accidental, and environmental threats. The catalog incorporates the threat event type, name, and description. For adversarial and accidental threats, it provides initiation requirements concerning their origin and minimum threat strength.

ISO 27005. While Annex C of ISO 27005 provides examples of typical threats, it lacks the detailed analysis necessary for this article.

These sources can serve as a starting point in identifying potential threat events that could impact your organization. Furthermore, you may refer to the earlier reports described in the “Identify information sources” activity. The goal is to identify not only current threats but also emerging threats for which you may need to prepare mitigation strategies.

To identify threat events relevant to your organization, examine your information assets, supporting assets, and technology objectives. The supporting assets will help you identify current applicable threat events, while the technology objectives will highlight future threats, particularly if your organization plans to adopt new or emerging technologies.

Also, consider your business model, industry sector, and the political, economic, regulatory, social, technological, and other environmental factors that influence your organization. These aspects also shape the nature of potential threat events.

Since you conduct this assessment at a strategic level, you might find it helpful to group specific threats and operate in terms of threat categories or domains rather than focusing on detailed techniques.

For each identified threat event, define the information security attribute the threat event can impact, e.g., confidentiality (C), integrity (I), and availability (A). You can store this information in the Impacted column – you can use it later when assessing the business impact of the threat event on your information assets.

You might also find it beneficial to include the name of the information source that helped you identify a specific threat event. References to trusted information sources increase the credibility of your research.

By the end of this activity, you should possess a comprehensive list of threat events relevant to your organization, each with its category and origin.

Map threat events to threat sources

The next step involves mapping threat events to the threat sources capable of triggering them you identified in step “4. Determine threat sources”. This critical process allows you to identify any threat sources within your environment with the potential to initiate specific threat events and to evaluate the likelihood of their occurrence.

However, this step poses a challenge, as numerous threat sources might trigger a single threat event. Similarly, a single threat source could potentially trigger several different threat events. Thus, a many-to-many relationship often exists between threat events and threat sources.

NIST advises mapping all threat sources to the threat events they could trigger, given that the threat probability and threat strength may vary for each pairing. Nevertheless, this approach might overly complicate the assessment, which is unnecessary for a strategic-level evaluation.

For this exercise, you could adopt a more straightforward method. For each threat event in your Threat Events table, identify a single, most relevant threat source in the Threat Sources table that meets the following criteria:

• Capable of initiating the selected threat event,
• Has the highest threat source criticality rating,
• The threat source origin aligns with the threat event origin. Some threat events, for example, could be initiated by internal threat sources like insiders with access to your internal network,
• Threat source intent is aligned with the type of initiated event type. As an example, threat source interested in espionage will more likely initiate events leading to sensitive data theft than events focused on creating business disruption,
• The threat source strength is adequate to initiate the selected threat event. For instance, an individual hacker might lack the capability to launch an APT attack against your organization. However, nation-state actors or hacking groups might be capable.

After identifying the relevant threat source, assign it to the Threat Source column in the Threat Events table. Based on this selection, populate the Threat Source Probability, Threat Source Strength, and Threat Source Criticality columns in the same table. The Threat Events table is where all critical risk calculation elements can be stored. This data relates to the threat and will be used to assess inherent likelihood.

If no threat source can initiate a threat event, the event may not be relevant to your organization and should be discarded.

If multiple threat sources have the same threat source criticality, select the most relevant source based on the nature of the threat event.

As a result of this activity, you should have a list of threat events, each with additional information about the most relevant threat sources capable of initiating them.

Map threat events to impacted assets

Mapping threat events to impacted assets is crucial in evaluating threat event impact. To establish this mapping, follow the steps below:

Create a Threats-Assets table. Set up a table to store your mapping data. Include these columns:

Select threat event. Choose a relevant threat event from the Threat Event column in the Threat Events table. Based on this selection, the Threat Source, Threat Strength and Origin columns should be populated.

Map impacted assets. Take into account the threat source and determine which crown jewels you identified in step “3. Identify crown jewels” would be of interest to them. Evaluate the nature of the threat event and assess which types of supporting and, consequently, primary assets it can impact. For instance, web application attacks will affect web applications and hence all information assets reliant on web applications. Likewise, ransomware spreading across your network can impact most of your servers and the information assets they support. Using separate rows in your table, map each primary asset the selected threat can impact. Upon selecting an asset, populate the following columns: Supporting Assets, Impact – C, Impact – I, Impact – A. You can automate the process of filling in these columns using formulas available in your worksheet software.

Establish the overall impact. The business impact level of a threat event on a specific asset will depend on the affected information security attribute. Different attributes may sustain varying levels of impact. Review your Impacted column to identify which components could be affected, then select the highest rating from the relevant values in the Impact – C, Impact – I and Impact – A columns. As before, you can also automate this calculation using available formulas.

Repeat the three steps above for each identified threat event.

This mapping will later assist in assessing inherent impact.