Threat and Risk Terms

Before we dive into the motivations and thoughts of an adversary, let's first understand what are some of the terminologies around threat and risk.

Assets and threats

First up, let's talk about an asset. An asset is something that has value. So it could be money, it could be data, it could be programming, it could be a reputation, it could be a company, it could be the identity information, it could be the employees of the company.

When it comes to assets, there are threats to the assets. Threats are something that can decrease the value of that asset. So in this case right here, we have data, and data could be stolen, or that data could be altered, or it could be deleted. So these are the threats to that data.

The CIA triad

When it comes to threats to our different assets, there is a model that helps us visualize this. This is the CIA triad. And this really especially applies to things like data. When it comes to data, we need to keep this model in mind: that the C stands for confidentiality, the I stands for integrity, and the A stands for availability.

The idea behind confidentiality is that somebody who's not supposed to have access to this data can't have access to it, so they're not able to see it. We're keeping things confidential. The integrity piece here is the idea that this data is accurate and doesn't change, so there is an integrity in it. Then there is this availability. Availability is the idea that we make this data available to those who need it when they need it.

So when we have our data, if that data were to be stolen, we would say that there's a confidentiality issue, that somebody's got it, somebody has seen it that shouldn't have access to it. If there was some sort of alteration to this data, we would say that that's a problem with integrity. If that data was deleted, it's no longer available, or there are other ways besides just deleting to make it unavailable, and so we would say that this is a problem with availability.

Threat agents and risk

The threat agent is going to be the person or organization that's going to carry out that threat. So for instance, if we have data, which is the asset, and there's threats against it, for instance it could be stolen, then the threat agent is going to be that person or entity that's going to steal that data.

So what we have to do as security professionals is assess risk. Risk is an equation. It's the probability or likelihood that something's going to happen and the impact that it will have to the organization. So what's the probability of this data being stolen, and how would that impact the organization? We calculate that, and that becomes our risk.

As security professionals, we're going to want to mitigate risk. Mitigate risk means lowering risk. What that means is that we're either going to have to reduce the probability or likelihood something will happen, or reduce the impact, or we could reduce both at the same time. We mitigate risk by putting countermeasures or controls into place. Countermeasures or controls are things that we put into place to reduce risk. For instance, this data right here: we built a wall around it and put a gate on it. These are the controls or countermeasures that we put in place to mitigate risk.

Attack surface, vulnerabilities and exploitation

Attack surface is the surface that could be attacked. So in this case right here, we have a wall and a gate up, and we have a threat actor. Well, what does that threat actor have access to? It has access to the wall and the gate and nothing behind that. Well, that is the attack surface. So what the threat agent is going to do is explore that surface right there, explore it for weaknesses.

A vulnerability is a weakness in the system. So we see right here that this gate right here has a break in it. So that is a vulnerability that this setup has right there, that the threat agent can use to carry out the threat. When a threat agent uses a vulnerability, we call that an exploitation. The threat agent is exploiting that vulnerability to gain access to that data.

Exposure is when something gets exposed to the outside world or left open. In this case right here, the gate gets left open, and now the data could be accessible from outside threats. Well, the exposure now is that we've opened up the possibility that a threat could get to this data.

A breach happens when a threat agent goes beyond the boundaries that we want them to. So in this case right here, maybe they've gotten into our network, or maybe they've downloaded data and now they have access to our data. At that point in time, we call that a breach.

Indicators of compromise and defense in depth

As security professionals, we're going to be looking for indicators of compromise. Indicators of compromise is that we're going to look for the threat agent and signs that they've gotten into our network, that there has been some sort of breach. So that could be things like looking for log files, or inconsistent behaviors, or maybe some sort of data that's been corrupted. So we're going to look for these indicators, these different signs that there has been some sort of breach.

So what we need to do as security professionals is practice defense in depth. Defense in depth is the idea that we're going to put many layers of security in place. Any one of those layers could have some sort of vulnerability to it, and because we understand that something could be exposed or left open or have some sort of vulnerability to it that a threat agent can use, we'll put multiple items in place, multiple things in place, to stop that threat agent from attacking our network or creating a breach within our network.

So in this case right here, we've got a fence and we have a gate up. We've encrypted the data, so even if the data was stolen, they might not be able to access that data. We've also put a security guard in place to be able to monitor, to make sure that there's no threat agent trying to get into our network, trying to get in and steal our data. And then we also have some things like the surveillance camera to make sure that this threat agent doesn't get in, or if they do, that we can spot it right away, or go back and look to see what has happened within our network, within our infrastructure, what has happened to this data.

A real quick summary

An asset is something that has value to the company. For instance, this is going to be data right here. Now, there are some things that can happen to that asset that would reduce its value, and that's the threat right there. For instance, it could be stolen. And who could it be stolen by? It could be stolen by some sort of organization or person. We call that the threat agent, or we could also call it the adversary. It actually goes by many different names.

And so that threat agent is going to try to steal that data. So what we're going to do is we're going to put mitigation in place, such as walls and gates, to guard against that, to reduce the amount of the risk. The risk is the probability or likelihood that something would happen times the impact. We want to reduce the probability and or the impact to reduce the amount of risk of that data getting stolen. But anything that we put in place could have vulnerabilities, that this threat agent exploits that vulnerability to create a breach where they steal the data. So we want to practice defense in depth and put multiple measures in place to protect that asset and the threat to that asset.