DerpGRC

    Topics in this domain

    The Changing Threat Landscape and Threat Modelling

    Risk events and threats · 1 min read

    Threats keep changing

    Emerging threats: AI-enabled attacks, risks to AI systems, cloud and identity, supply chain, ransomware and extortion, OT, IoT and quantum.

    The threat landscape changes constantly. When it does, the affected risk scenarios must be reassessed, without waiting for the annual cycle.

    Using threat intelligence

    Strategic intelligence for the board, operational for managers, tactical for defenders, technical indicators for the SOC.

    Threat intelligence is useful only when it’s filtered for relevance to the organisation’s sector, geography and technology.

    Example. Intelligence shows a ransomware group exploiting a specific VPN product in the organisation’s sector. The practitioner raises the likelihood of the related scenario and recommends the owner prioritise patching and MFA.

    How attacks unfold

    Attack chain: reconnaissance, initial access, foothold, lateral movement, act on objectives.

    Threat modelling

    STRIDE: spoofing, tampering, repudiation, information disclosure, denial of service, elevation of privilege, with what each violates and example controls.

    Threat modelling finds threats to a system during design, when fixes are cheapest.

    How the exam asks about it

    If the question asks…The answer is usually…
    BEST time for threat modellingDuring design
    Most useful threat intelligenceFiltered for relevance to the organisation
    Major new threat in the sectorReassess the affected risk scenarios now
    Intelligence for the boardStrategic trends and business implications

    In short

    • The threat landscape changes constantly; risk assessments must be updated when it does.
    • Threat intelligence is useful only when filtered for relevance to the organisation's sector, geography and technology.
    • Different audiences need different levels of intelligence: strategic, operational, tactical and technical.
    • Threat modelling finds threats to a system during design, when fixes are cheapest.
    • Frameworks such as STRIDE and MITRE ATT&CK structure threat modelling and analysis.

    Exam traps

    • Collecting large volumes of threat feeds without filtering or using them.
    • Threat modelling after go-live instead of during design.
    • Waiting for the annual assessment to react to a major new threat.
    • Giving the board technical indicators instead of strategic trends.

    Slides

    Click the slide and use the arrow keys. F toggles full screen.

    CRISC · Domain 2 · Risk events and threats

    The Changing Threat Landscape and Threat Modelling

    How the risk practitioner keeps up with changing threats through threat intelligence, and uses threat modelling to find threats to a system before it's built.

    1 / 8