August 22, 2016 By Stiliyana Simeonova 3 min read

This is the third and final installment in this series on threat modeling. For the full story, read Part 1 and Part 2 first.

Previously, we discussed why threat modeling could be useful in your enterprise context and outlined the basic approach to performing threat modeling exercises. Now we will focus on how it all fits together to assess security risk and inform further strategic or operational decisions.

Evaluating Risk

The ultimate goal of every threat modeling process is to facilitate the organizational risk assessment effort. One of the most widely used risk evaluation formulas states that risk is a product of the probability that a certain attack will take place and the potential impact of the attack: Risk = Impact x Probability.

When evaluating overall risk, business impact is probably the most widely explored property. Most organizations have well-defined asset classification policies to help formalize the importance of different assets to the business. It is vital to have these policies on hand while assessing the impact of an identified threat or attack path.

If your organization has no formal data classification policy, you should work with the appropriate business owners to fill in the gaps. Make sure to approach people who understand the business value as well as the technical value of the assets under consideration.

When assessing the probability or likelihood of a threat to materialize, it’s important to think about security controls and vulnerabilities. Most organizations are familiar with concepts such as security controls evaluation, gap analysis, vulnerability identification and treatment. While these areas should be considered when analyzing threats and overall risk, it’s easy to overlook the threat actors’ motivations and capabilities.

Threat Actors Come in All Shapes and Sizes

Threat actors give life to a particular threat and are capable of exploiting the chain of vulnerabilities in different attack paths. Their goal is to negatively impact your business in one way or another. In this respect, threat actors could aim for any of the four big security properties: availability, integrity, confidentiality and privacy, or any combination thereof.

In most cases the threat actors fall into one of four categories:

  • Insider trusted (privileged users, etc.);
  • Insider untrusted (contractors, regular users, etc.);
  • External trusted (supplier, partner, service provider, etc.); or
  • External untrusted (competitors, cybercriminals, hacktivists, whistleblowers, etc.).

Quantifying Threat Level

The threat actor’s motivation and capability can be analyzed to produce a threat level measurement using the following formula: Threat Level = Motivation x Capability.

Depending on your organization’s risk evaluation process, you may take a different approach to quantifying threat level. The following heat map represents one such approach:

Figure 1: Threat Actor Motivation and Capability Heat Map

A Multitude of Malicious Motives

Threat actors are motivated by a multitude of factors, depending on a particular actor’s relationship to the organization and level of access within the IT environment.

A privileged, internal trusted user, for example, may be motivated by a desire for some type of revenge against the company. An internal trusted user, such as a third-party contractor, or an external trusted user, such as a supplier, may seek to gain an unfair advantage by accessing sensitive data and company secrets. Finally, an external untrusted user, such as a hacktivist or other type of cybercriminal, may carry out an attack for purely political or criminal reasons. Virtually all threat actors are motivated by the potential for financial gain.

Meanwhile, the capability levels of different actors in the different categories could vary widely.

Considering this fact, and the fact that few companies specialize in threat data gathering and analysis, it is highly advisable to choose one or more threat intelligence providers to supply quality information about the current and emerging threat vectors targeting your company.

Threat Modeling for an Evolving IT Landscape

It is important to remember that the threat landscape is constantly changing, and your business is also evolving. Regularly revisit your threat models and threat actor analyses to ensure that your risk decisions are in sync with the current state of affairs.

There is much more to be said about the existing threat modeling methodologies and their possible applications as part of an organization’s risk management program, but I hope this series sparked interest and offered a good starting point to explore the concept of threat modeling.

Learn more about X-Force Red and IBM’s specialized pen testing services

More from CISO

Overheard at RSA Conference 2024: Top trends cybersecurity experts are talking about

4 min read - At a brunch roundtable, one of the many informal events held during the RSA Conference 2024 (RSAC), the conversation turned to the most popular trends and themes at this year’s events. There was no disagreement in what people presenting sessions or companies on the Expo show floor were talking about: RSAC 2024 is all about artificial intelligence (or as one CISO said, “It’s not RSAC; it’s RSAI”). The chatter around AI shouldn’t have been a surprise to anyone who attended…

Why security orchestration, automation and response (SOAR) is fundamental to a security platform

3 min read - Security teams today are facing increased challenges due to the remote and hybrid workforce expansion in the wake of COVID-19. Teams that were already struggling with too many tools and too much data are finding it even more difficult to collaborate and communicate as employees have moved to a virtual security operations center (SOC) model while addressing an increasing number of threats.  Disconnected teams accelerate the need for an open and connected platform approach to security . Adopting this type of…

The evolution of a CISO: How the role has changed

3 min read - In many organizations, the Chief Information Security Officer (CISO) focuses mainly — and sometimes exclusively — on cybersecurity. However, with today’s sophisticated threats and evolving threat landscape, businesses are shifting many roles’ responsibilities, and expanding the CISO’s role is at the forefront of those changes. According to Gartner, regulatory pressure and attack surface expansion will result in 45% of CISOs’ remits expanding beyond cybersecurity by 2027.With the scope of a CISO’s responsibilities changing so quickly, how will the role adapt…

Topic updates

Get email updates and stay ahead of the latest threats to the security landscape, thought leadership and research.
Subscribe today