Threat (computer security)

Threats classification

Threats can be classified according to their type and origin:

• Types of threats:
  • Physical damage: fire, water, pollution
  • Natural events: climatic, seismic, volcanic
  • Loss of essential services: electrical power, air conditioning, telecommunication
  • Compromise of information: eavesdropping, theft of media, retrieval of discarded materials
  • Technical failures: equipment, software, capacity saturation
  • Compromise of functions: error in use, abuse of rights, denial of actions

Note that a threat type can have multiple origins.

• Deliberate: aiming at information asset
  • spying
  • illegal processing of data
• Accidental
  • equipment failure
  • software failure
• Environmental
  • natural event
  • loss of power supply
• Negligence: Known but neglected factors, compromising the network safety and sustainability

Threats trends

Recent trends in computer threats show an increase in ransomware attacks, supply chain attacks, and fileless malware. Ransomware attacks involve the encryption of a victim's files and a demand for payment to restore access. Supply chain attacks target the weakest links in a supply chain to gain access to high-value targets. Fileless malware attacks use techniques that allow malware to run in memory, making it difficult to detect.

Common threats

Below are the few common emerging threats:

• Computer viruses
• Trojan horses
• Worms
• Rootkits
• Spyware
• Adware
• Ransomware
• Fileless malware

Threat classification

Microsoft published a mnemonic, STRIDE, from the initials of threat groups:

• Spoofing of user identity
• Tampering
• Repudiation
• Information disclosure (privacy breach or Data leak)
• Denial of Service (D.o.S.)
• Elevation of privilege

Microsoft previously rated the risk of security threats using five categories in a classification called DREAD: Risk assessment model.

The spread over a network of threats can lead to dangerous situations. In military and civil fields, threat level has been defined: for example INFOCON is a threat level used by the US. Leading antivirus software vendors publish global threat level on their websites.

Associated terms

Threat agents or actors

In cybersecurity and risk assessment, a threat actor (or threat agents, attackers, or adversaries) is a person, group, organisation, state, or other entity with the ability to cause, carry, transmit, support, or exploit a threat.

Threat actors are commonly analysed according to their motivations, resources, technical capability, access to systems, relationship to a target, and degree of connection to state authority. They may exploit vulnerabilities, conduct social engineering, steal or monetise data, disrupt operations, or support other actors who carry out such activity. Because the term covers a wide range of actors, researchers and security organisations use taxonomies that distinguish between groups such as cybercriminals, state-linked actors, ideologically motivated actors, thrill seekers or trolls, insiders, and competitors.

Threat actor classifications are used in risk management, cyber threat intelligence, and incident response to connect observed behaviour with possible objectives and likely future activity. The categories are not always mutually exclusive: the same actor may combine criminal, ideological, commercial, or state-linked motivations, and different organisations may use different names for similar actors.

Threat action

A threat action is an assault on system security. A complete security architecture deals with both intentional acts and accidental events.

Threat analysis

Threat analysis is the analysis of the probability of occurrences and consequences of damaging actions to a system. It forms the basis of risk analysis.

Threat modeling

Threat modeling is a process that helps to identify and prioritize potential threats to systems. It involves analyzing a system's architecture, identifying potential threats, and prioritizing them based on their impact and likelihood. By using threat modeling, organizations can develop a proactive approach to security and prioritize their resources to address the most significant risks.

Threat intelligence

Threat intelligence is the practice of collecting and analyzing information about potential and current threats to a system. This information can include indicators of compromise, attack techniques, and threat-actor profiles.

Threat consequence

Threat consequence is a security violation that results from a threat action.

Threat landscape or environment

A threat landscape comprises a collection of threats in a particular domain or context, with information on identified vulnerable assets, threats, risks, threat actors and observed trends.

Threat surface

The threat surface is the sum total of all the ways that a threat can cross a boundary that threats (natural, accidental, or deliberate) "have to cross in order to access the [...] information inside the threat surface"; threat surfaces may oppose physical, logical or administrative threats. Components of a threat surface might include devices such as smartphones, tablets, laptops, or the Internet of Things.

Threat management

Threats should be managed by operating an ISMS, performing all the IT risk management activities foreseen by laws, standards and methodologies.

Very large organizations tend to adopt business continuity management plans in order to protect, maintain and recover business-critical processes and systems. Some of these plans are implemented by computer security incident response team (CSIRT).

Threat management must identify, evaluate, and categorize threats. There are two primary methods of threat assessment:

• Information security audit
• Penetration test

Many organizations perform only a subset of these methods, adopting countermeasures based on a non-systematic approach, resulting in computer insecurity.

Information security awareness is a significant market. There has been a lot of software developed to deal with IT threats, including both open-source software and proprietary software.

Cyber threat management

Threat management involves a wide variety of threats including physical threats like flood and fire. While ISMS risk assessment process does incorporate threat management for cyber threats such as remote buffer overflows the risk assessment process doesn't include processes such as threat intelligence management or response procedures.

Cyber threat management (CTM) is emerging as the best practice for managing cyber threats beyond the basic risk assessment found in ISMS. It enables early identification of threats, data-driven situational awareness, accurate decision-making, and timely threat mitigating actions.

CTM includes:

• Manual and automated intelligence gathering and threat analytics
• Comprehensive methodology for real-time monitoring including advanced techniques such as behavioral modelling
• Use of advanced analytics to optimize intelligence, generate security intelligence, and provide Situational Awareness
• Technology and skilled people leveraging situational awareness to enable rapid decisions and automated or manual actions

Threat hunting

Cyber threat hunting is "the process of proactively and iteratively searching through networks to detect and isolate advanced threats that evade existing security solutions."

The SANS Institute has conducted research and surveys on the effectiveness of threat hunting to track and disrupt cyber adversaries as early in their process as possible. According to a survey performed in 2019, "61% [of the respondents] report at least an 11% measurable improvement in their overall security posture" and 23.6% of the respondents have experienced a 'significant improvement' in reducing the dwell time.