Threat Types - What is a brief Taxonomy of threats? How can it be broken down.
Just some thoughts.
•Internal Undirected
•Internal Directed
•External Undirected
•External Directed
Threat Types - Internal Undirected
Single Point Mistakes
Cascading Mistakes
Systemic Failures
Equipment Failure
Threat Type - Internal Directed
Fraud
Sabotage
Information Theft
Resource Redirection
Threat Type - External Undirected
Disasters Service Failure (power, building, metropolitan)
Info Security Events (Viruses, Worms, Spyware)
Government Events
Global IT issues (Mass Scans, Naming Attacks)
More
Threat Type - External Directed
Hacking
Industrial
Espionage
Terrorism
Sabotage
How would you Break it down? What would you add to groupings and to the listings?
Subscribe to:
Post Comments (Atom)
2 comments:
Excellent post!
I usually use Internal/External and then instead of directed I use "technical (T) /non-technical (NT)".
Both T and NT can then be human/non-human. Then I classify potential types of contact as potentially, "random, intentional, or regular" - which may be similar to directed/non-directed.
As an example an "external technical human" threat that has a significant threat capability (a rating in a population distribution that considers skills and resources) we can account for the probability of either intentional or random contact.
Thanks and I agree. There are several different ways to break up the vectors to the Impact. The more quanta we have to assess the more points that can be checked to see if that is the right empirical path. Different patterns fit in different senerios. I usually try to use context do define how I am looking at it.
Post a Comment