THREAT INTERACTION Summary This helps the auditor enumerate threats that the organization is concerned about and the internal priorities of them. At the same time, it enables a discussion of how threats can interrelate and helps define the difference between a threat and a risk (a threat that has a vulnerability associated with it), and the value of mitigation. This exercise works well with larger groups, and can be woven in to the Threat Identification activity. Overview Split participants into small groups and have them brainstorm on all possible threats, writing each on a separate stickie Cluster the stickies to reveal duplicate concerns across the group and thematic areas Mark the threats which have occurred Select one threat and arrange other threats, where relevant, as potential causes or outcomes of that threat Materials Needed Stickies (ideally 3 colors) Pens/sharpies for participant groups Markers Camera to digitally capture the data Whiteboard or flip-chart Considerations Treat threat and adversary data with the utmost security. Ensure that any physical notes/drawings are erased and destroyed once digitally recorded. Ensure that any digital recordings of this process are kept secure and encrypted. Consider who has physical and visual access to the room where this process takes place, and if the room can be secured if this activity may span long/overnight breaks. Page 158 of 240