describes where a threat originates and the path it takes to reach its target.
Threat Vectors
This process involves identifying potential incidents, identifying what is being protected, and determining who might exploit those weaknesses. It provides focus to a security strategy and helps avoid overlooking significant risks.
Threat Definition
TYPES OF ATTACKS
viruses, worms, Trojans
Malicious mobile code
TYPES OF ATTACKS
banner grabbing or packet sniffing
Manual Attacks
TYPES OF ATTACKS
stealthy, targeted attacks often sponsored by hostile governments for political or financial gain.
Advanced Persistent Threats (APTs)
This involves creating an inventory of items to protect and determining their value in terms of criticality to the business.
Asset Identification and Valuation
____ uses actual monetary values and formulas like Annualized Loss Expectancy (ALE), which multiplies the cost of a single loss (SLE) by the expected frequency of that event per year (ARO).
Quantitative ANalysis
____ is often more practical for smaller environments, focusing on assigning severity levels (such as High, Medium, or Low) to threats and assets to guide prioritization.
Qualitative Analysis
Risk analysis recognizes that attackers will focus on the easiest path of entry, meaning security must be equivalent or transitive across all systems—technical and non-technical—that have access to a specific asset.
Weakest Link Principle
___ is a term used to describe where a threat originates and the path it takes to reach a target.
Threat Vector
SECURITY CONTROL CATEGORIES
blocking threats
Preventative
SECURITY CONTROL CATEGORIES
noticing attacks
detective
SECURITY CONTROL CATEGORIES
discouraging violations
deterrent
SECURITY CONTROL CATEGORIES
restoring integrity
corrective
SECURITY CONTROL CATEGORIES
restoring availability
recovery
SECURITY CONTROL CATEGORIES
backup layers
Recovery
SAMPLE THREATS VECTOR ELEMENTS
Lock
Preventative
SAMPLE THREATS VECTOR ELEMENTS
Firewalls
Preventative
SAMPLE THREATS VECTOR ELEMENTS
Guards on Station
Preventative
SAMPLE THREATS VECTOR ELEMENTS
Cameras
Detective
SAMPLE THREATS VECTOR ELEMENTS
IDS, logging, SIEM
Detective
SAMPLE THREATS VECTOR ELEMENTS
Guards Patrolling
Detective
SAMPLE THREATS VECTOR ELEMENTS
Signs barbed wire
Deterrent
SAMPLE THREATS VECTOR ELEMENTS
Security policies
Deterrent
