This is the third and final installment in this series on threat modeling. For the full story, read Part 1 and Part 2 first.

Previously, we discussed why threat modeling could be useful in your enterprise context and outlined the basic approach to performing threat modeling exercises. Now we will focus on how it all fits together to assess security risk and inform further strategic or operational decisions.

Evaluating Risk

The ultimate goal of every threat modeling process is to facilitate the organizational risk assessment effort. One of the most widely used risk evaluation formulas states that risk is a product of the probability that a certain attack will take place and the potential impact of the attack: Risk = Impact x Probability.

When evaluating overall risk, business impact is probably the most widely explored property. Most organizations have well-defined asset classification policies to help formalize the importance of different assets to the business. It is vital to have these policies on hand while assessing the impact of an identified threat or attack path.

If your organization has no formal data classification policy, you should work with the appropriate business owners to fill in the gaps. Make sure to approach people who understand the business value as well as the technical value of the assets under consideration.

When assessing the probability or likelihood of a threat to materialize, it’s important to think about security controls and vulnerabilities. Most organizations are familiar with concepts such as security controls evaluation, gap analysis, vulnerability identification and treatment. While these areas should be considered when analyzing threats and overall risk, it’s easy to overlook the threat actors’ motivations and capabilities.

Threat Actors Come in All Shapes and Sizes

Threat actors give life to a particular threat and are capable of exploiting the chain of vulnerabilities in different attack paths. Their goal is to negatively impact your business in one way or another. In this respect, threat actors could aim for any of the four big security properties: availability, integrity, confidentiality and privacy, or any combination thereof.

In most cases the threat actors fall into one of four categories:

• Insider trusted (privileged users, etc.);
• Insider untrusted (contractors, regular users, etc.);
• External trusted (supplier, partner, service provider, etc.); or
• External untrusted (competitors, cybercriminals, hacktivists, whistleblowers, etc.).

Quantifying Threat Level

The threat actor’s motivation and capability can be analyzed to produce a threat level measurement using the following formula: Threat Level = Motivation x Capability.

Depending on your organization’s risk evaluation process, you may take a different approach to quantifying threat level. The following heat map represents one such approach:

Figure 1: Threat Actor Motivation and Capability Heat Map

A Multitude of Malicious Motives

Threat actors are motivated by a multitude of factors, depending on a particular actor’s relationship to the organization and level of access within the IT environment.

A privileged, internal trusted user, for example, may be motivated by a desire for some type of revenge against the company. An internal trusted user, such as a third-party contractor, or an external trusted user, such as a supplier, may seek to gain an unfair advantage by accessing sensitive data and company secrets. Finally, an external untrusted user, such as a hacktivist or other type of cybercriminal, may carry out an attack for purely political or criminal reasons. Virtually all threat actors are motivated by the potential for financial gain.

Meanwhile, the capability levels of different actors in the different categories could vary widely.

Considering this fact, and the fact that few companies specialize in threat data gathering and analysis, it is highly advisable to choose one or more threat intelligence providers to supply quality information about the current and emerging threat vectors targeting your company.

Threat Modeling for an Evolving IT Landscape

It is important to remember that the threat landscape is constantly changing, and your business is also evolving. Regularly revisit your threat models and threat actor analyses to ensure that your risk decisions are in sync with the current state of affairs.

There is much more to be said about the existing threat modeling methodologies and their possible applications as part of an organization’s risk management program, but I hope this series sparked interest and offered a good starting point to explore the concept of threat modeling.

Learn more about X-Force Red and IBM’s specialized pen testing services