Privacy, Regulations, and Cybersecurity

CHAPTER 15Threat Assessment

The difference between theft and destruction is often a few keystrokes.

—Dmitri Alperovitch

Now that you have a solid understanding of not only what specific assets you're protecting but also what those assets are worth, it's time to consider who might be coming after them and how that might occur.

In order to get a handle on this, you'll need to perform some threat assessments. But before you start, there are four concepts you need to understand right away: threat, attack, vector, and payload.

• Threat refers to the potential of an agent to cause adverse effects on an asset.
• Attack is the realization of a threat.
• Vector is the pathway that a threat takes to compromise an asset.
• Payload is the actual way that the compromise is effected.

As outlined by the wise people at NIST: the threat source (also called an agent) initiates the threat event (or attack); the threat event exploits one or more vulnerabilities that cause adverse impact (you got hacked!); the end result produces organizational risk. And migraines. Painful, splitting migraines.

In terms of risk, a cyber threat has three main attributes: the kind of threat agent, the probability of occurrence, and, of course, its impact. During our threat assessment, our goal is to determine all three attributes on a per-asset basis. To do this, we'll need to know what the assets are (which we have already accomplished), what their value is to us (our definition of impact), who the threat agents might ...