The goal is to be able to answer the following questions: Threat History What history of attacks does the threat actor have? What techniques have they used? Have they targeted vulnerabilities that the organization currently has? What is known about the types of threats used by an threat actor to attack similar organizations? Threat Capability Does the threat actor have the means to exploit a vulnerability that the organization currently has? Does the threat actor have the means to leverage widespread threats against all similar organizations, or will they have to prioritize their targets? Threat Intent Have they targeted similar organizations? Does the threat actor currently have the desire to conduct an attack against this type of organization? Is the organization a priority threat target for the threat actor? Overview Identify and categorize threats to processes or data (requires a process or data mapping exercise) by Confidentiality, Control, Integrity, Identity, Availability, and Auditability Identify the impact of each threat against People, Organization, and Program Brainstorm potential Adversaries and note their History, Intent, and Capability per Threat For Threats with identified Adversaries, rank them on a linear scale from "Inconvenient" to "Severe" (no two items can have the same rank) Materials Needed The outputs from a process or data mapping exercise to work from Stickies Whiteboard or flip-chart (whiteboard preferred) Markers Camera to digitally capture the data Page 152 of 240