Risk Assessment · Topic 1 of 6
Risk Events, Threat Modeling and the Threat Landscape
CRISC risk events and threats: threat sources and actors, the threat landscape, threat intelligence, and threat modeling with STRIDE, PASTA and ATT&CK.
- 4 min
- Risk events can be realized or potential; past events are strong evidence.
- Threat sources: adversarial, accidental, structural, environmental, plus third parties.
- Adversarial threats are judged by capability, intent and targeting.
What it is
A risk event is something that happens, or could happen, and affects objectives: an outage, a data breach, a fraud, a supplier failure. A threat is anything that could cause such an event by exploiting a weakness. The threat landscape is the current set of threats relevant to the organization and how they are changing.
Threat modeling is a structured way to work out how a system or process could be attacked or fail, so controls can be designed before the event happens.
How it works
Risk events
Risk events can be realized (they already happened, such as last month's outage) or potential (they might happen). Realized events are valuable evidence: incident records, loss data, audit findings and near misses show where controls failed and how often.
Events are not only security incidents. They include project failures, processing errors, regulatory breaches, supplier collapse and missed opportunities from technology the business did not adopt.
Threat sources
| Source | Examples |
|---|---|
| Adversarial | Criminal groups, nation states, hacktivists, malicious insiders, competitors |
| Accidental | Staff errors, misconfiguration, deleting the wrong data |
| Structural | Hardware failure, software bugs, capacity exhaustion |
| Environmental | Fire, flood, storm, power loss, pandemic |
| Third party | Supplier outage, cloud provider failure, compromised software update |
NIST SP 800-30 Rev 1 uses the adversarial, accidental, structural and environmental categories. For adversarial threats it considers capability, intent and targeting; for the others it considers the range of effects.
Insiders deserve special attention. They already have access, so perimeter controls do not stop them. Insider risk can be malicious or simply careless.
The threat landscape and intelligence
The practitioner keeps the threat landscape current using threat intelligence: vendor and government reports, industry sharing groups, security operations data and incident trends. Intelligence is useful only when it is relevant to the organization's sector, technologies and assets.
| Intelligence level | Audience | Example |
|---|---|---|
| Strategic | Executives, board | Ransomware groups are targeting the healthcare sector |
| Operational | Security managers | A campaign is exploiting a specific VPN product |
| Tactical or technical | Analysts, tools | Indicators of compromise such as IP addresses and file hashes |
Changes in the landscape are a trigger to review risk scenarios and ratings.
Threat modeling methods
| Method | Focus |
|---|---|
| STRIDE | Six threat types: Spoofing, Tampering, Repudiation, Information disclosure, Denial of service, Elevation of privilege |
| PASTA | Process for Attack Simulation and Threat Analysis, a seven-stage, risk-centric method linking threats to business impact |
| MITRE ATT&CK | Knowledge base of real adversary tactics and techniques, used to check detection and control coverage |
| Attack trees | Diagram of the paths an attacker could take to reach a goal |
A typical threat model draws the system and its data flows, marks trust boundaries, lists threats at each element, and records the controls that address them. It is most valuable during design, when changes are cheap.
A worked example
A hospital plans a patient portal. The practitioner facilitates a threat modeling session with the developers and the clinical owner. Using STRIDE on the data flow diagram, the team finds that the appointment API trusts a patient ID sent by the browser, which allows information disclosure of other patients' records.
The design is changed so the server derives the patient ID from the authenticated session. Threat intelligence also shows ransomware actively targeting hospitals, so the scenario for portal unavailability is rated higher than the team first assumed.
How the exam asks about this
- "Which source BEST helps identify realistic risk events for the organization?" Its own incident, loss and near miss history, supplemented by relevant threat intelligence.
- "When is threat modeling MOST effective?" During design, before the system is built.
- "A new threat is reported against technology the organization uses. What should the practitioner do FIRST?" Determine whether and where the organization is exposed, then review the affected risk scenarios.
What to remember for the exam
- Risk events can be realized or potential; past events are strong evidence.
- Threat sources: adversarial, accidental, structural, environmental, plus third parties.
- Adversarial threats are judged by capability, intent and targeting.
- Threat intelligence must be relevant to the organization to be useful.
- Threat modeling works best at design time; STRIDE names six threat types.
A threat with no matching vulnerability or exposure is not yet a risk to the organization. Before raising a rating because of news, confirm the organization is actually exposed.
Common mistakes
Thinking only of hackers. Errors, failures, disasters and suppliers cause many real losses.
Collecting intelligence nobody uses. Threat feeds help only if they change scenarios, ratings or controls.
Threat modeling after go-live. It still helps, but fixing design flaws late is far more expensive.
Check yourself
What are the four threat source categories used in NIST SP 800-30 Rev 1?
Adversarial, accidental, structural and environmental.
Why are realized risk events valuable to the practitioner?
They show where controls actually failed and give real data on frequency and impact for future assessments.
What does STRIDE stand for?
Spoofing, Tampering, Repudiation, Information disclosure, Denial of service and Elevation of privilege.
Topic 1 of 6 in Risk Assessment
Test yourself on Risk Assessment
The full ISACA CRISC question bank has 1,000 questions, with timed practice exams and an explanation for every answer.
This study guide is independent and is not affiliated with, endorsed by, or sponsored by ISACA. Vendor names, certification names and exam codes are trademarks of their respective owners and are used for identification only.