Threat Assessment

Summary

This objective uses a variety of activities to identify possible attackers and gather background information about the capability of those attackers to threaten the organization. This consists of identifying a particular attacker's history of carrying out specific threats, their capability to carry out those threats currently, and proof that the threat has intent to leverage resources against the target.

Purpose

Checking the assumptions both of the organization and of the auditor by researching the current threats will ensure that an auditor is basing their work on accurate assessments of the conditions the organization faces and that they are making informed operational security considerations. With greater ownership of the process the staff provides an opportunity to explore their threat landscape and become more engaged in addressing the threats identified when the audit is complete. By engaging with as many staff as possible the auditor is providing a framework for staff to explore threat identification processes when the auditor is gone.

The Flow Of Information

Guiding Questions

• Who are potential adversaries for the organization?
• Do these threat actors have a history of attacks? Against whom?
• What types of organizations have they targeted?
• Does the threat actor have the means to leverage widespread threats against, or will they have to prioritize their targets? Is the organization a priority threat target?
• Do they have the desire and ability to conduct an attack?

Approaches

• Open Source Threat Research: Identify possible adversaries and threats using publicly available reports, news, and databases.
• Threat Mapping: Facilitate group activities where staff identify possible adversaries and the threats that they have/can leverage against the group.

Outputs

• A host driven threat-matrix including the following:
  • Adversaries (threat actors) with capabilities and willingness
  • Impacts of attacks against critical processes, ranked by severity
  • Likelihood of each (based on adversaries)
• Latest general cyber-security threats
• Identify existing in/formal security practices that the participants use to address risks.

Operational Security

• Data generated in this component is highly sensitive - in addition to standard practices of saving only in encrypted containers and destroying physical copy versions (stickies, etc.) ans using VPNs/Tor to conduct research, also take note of the physical location where you are conducting any exercises to prevent eavesdropping/viewing.

Preparation

• Threat Identification works best grounded against mapped out organizational processes or a data/asset map. See the Process Mapping and Data Assessment methods for exercises to generate these.

Resources

Activities

undefined

---

1. Corruption Perception Index↩

2. The ISC Project completes evaluations of information security threats in a broad range of countries. The resulting comprehensive written assessments describe each country’s digital security situation through consideration of four main categories: online surveillance, online attacks, online censorship, and user profile/access.↩

3. EISF distributes frequent analysis and summaries of issues relevant to humanitarian security risk management.↩

4. The top 500 sites in each country or territory.↩

5. Who publishes Transparency Reports?↩