
This is the Title of the Book, eMatter Edition
Copyright © 2007 O’Reilly & Associates, Inc. All rights reserved.
6
|
Chapter 1: Threat Modeling and Risk Management
Threats
Who might attack your system, network, or data? Cohen et al,
*
in their scheme for
classifying information security threats, provide a list of actors (threats), which illus-
trates the variety of attackers that any networked system faces. These attackers
include the mundane (insiders, vandals, maintenance people, and nature), the sensa-
tional (drug cartels, paramilitary groups, and extortionists), and all points in
between.
As you consider potential attackers, consider two things. First, almost every type of
attacker presents some level of threat to every Internet-connected computer. The
concepts of distance, remoteness, and obscurity are radically different on the Inter-
net than in the physical world, in terms of how they apply to escaping the notice of
random attackers. Having an “uninteresting” or “low-traffic” Internet presence is no
protection at all against attacks from strangers.
For example, the level of threat that drug cartels present to a hobbyist’s basement
web server is probably minimal but shouldn’t be dismissed altogether. Suppose a sys-
tem cracker in the employ of a drug cartel wishes to target FBI systems via inter-
mediary (compromised) hosts to make his attacks harder to trace.
Arguably, this particular scenario ...