DerpGRC

    Topics in this domain

    Threat Sources, Actors and Motivations

    Risk events and threats · 1 min read

    Four sources of threat

    • Adversarial: people with intent, such as criminals, insiders and nation-states.
    • Accidental: mistakes, such as a misdirected email or a wrong configuration.
    • Structural: failures of hardware, software or capacity.
    • Environmental: fire, flood, power loss or pandemic.

    Accidental and structural threats cause many incidents and are often underweighted.

    Who attacks, and why

    Threat actors with motivation, capability and typical targets: nation-state, organised crime, hacktivists, malicious and careless insiders, competitors, opportunists.

    Motivation drives likelihood

    A threat is more likely when an actor has both the motive and the capability. A hospital is attractive to ransomware gangs because it can’t tolerate downtime; a defence contractor attracts nation-states because of its secrets.

    Example. A small accounting firm assumed it was too small to target. Organised criminals didn’t care: the firm held hundreds of clients’ tax records and paid a ransom faster than a large company would.

    Don’t forget the insider

    • Already has access and knowledge.
    • Bypasses perimeter controls.
    • Can be malicious or simply careless.
    • Controls: least privilege, segregation of duties, monitoring and a prompt leaver process.

    How the exam asks about it

    If the question asks…The answer is usually…
    Why consider threat actor motivationIt affects likelihood and targets
    Threat that bypasses perimeter controlsInsider
    MOST common cause of many incidentsHuman error and failures, not only attacks
    Small organisation thinks it’s not a targetOpportunistic and criminal actors still target it

    In short

    • Threat sources are adversarial (people with intent), accidental (mistakes), structural (failures) and environmental (natural and physical events).
    • Adversarial actors include nation-states, organised crime, hacktivists, insiders, competitors and opportunists.
    • Motivation and capability decide what an actor targets and how hard they try.
    • Insiders matter because they already have legitimate access.
    • Accidental and structural threats cause many incidents and are often underweighted.

    Exam traps

    • Focusing only on external hackers and ignoring errors, failures and insiders.
    • Rating likelihood without considering who would want to attack and why.
    • Assuming the organisation is too small to be targeted.
    • Treating every actor as equally capable.

    Slides

    Click the slide and use the arrow keys. F toggles full screen.

    CRISC · Domain 2 · Risk events and threats

    Threat Sources, Actors and Motivations

    The sources of threat to IT (adversarial, accidental, structural and environmental), the main threat actors and why their motivation and capability shape likelihood.

    1 / 8