THREAT ASSESSMENT SUMMARY This objective uses a variety of activities to identify possible attackers and gather background information about the capability of those attackers to threaten the organization. This consists of identifying a particular attacker's history of carrying out specific threats, their capability to carry out those threats currently, and proof that the threat has intent to leverage resources against the target. PURPOSE Checking the assumptions both of the organization and of the auditor by researching the current threats will ensure that an auditor is basing their work on accurate assessments of the conditions the organization faces and that they are making informed operational security considerations. With greater ownership of the process the staff provides an opportunity to explore their threat landscape and become more engaged in addressing the threats identified when the audit is complete. By engaging with as many staff as possible the auditor is providing a framework for staff to explore threat identification processes when the auditor is gone. THE FLOW OF INFORMATION Information Threats Actors Results Threats Activity Actors Capacity Capacity Activities Activities Barriers Barriers Assets Assets Vulnerabilities Vulnerabilities Threat Assessment Information Flow GUIDING QUESTIONS Who are potential adversaries for the organization? Do these threat actors have a history of attacks? Against whom? What types of organizations have they targeted? Does the threat actor have the means to leverage widespread threats against, or will they have to prioritize their targets? Is the organization a priority threat target? Do they have the desire and ability to conduct an attack? APPROACHES Open Source Threat Research: Identify possible adversaries and threats using publicly available reports, news, and databases. Threat Mapping: Facilitate group activities where staff identify possible adversaries and the threats that they have/can leverage against the group. Page 146 of 240