This chapter is from the book
This chapter is from the book
This chapter is from the book
Threats to Security
Chapter 2, “Risk Management,” quotes the NIST SP 80-37 Rev. 2 definition of a threat. NIST provides an alternative but similar definition of threat in SP 1800-15:
Any circumstance or event with the potential to adversely impact organizational operations (including mission, functions, image, or reputation), organizational assets, or individuals through an information system via unauthorized access, destruction, disclosure, modification of information, and denial of service. Also, the potential for a threat source to successfully exploit a particular information system vulnerability.
Understanding the threats that could impact an organization enables cybersecurity professionals to develop and implement strategies to help prevent unauthorized access and harm to data. With cyber threats evolving constantly, professionals need to be aware of any new tactics and techniques attackers may use to exploit vulnerabilities in an organization’s environment.
Staying updated with the latest news in the cybersecurity world enables professionals to stay one step ahead of threat actors by proactively implementing effective mitigation and protection measures before these malicious actors exploit any vulnerabilities, thereby safeguarding their systems and data.
Security breaches occur when threat actors exploit vulnerabilities and gain unauthorized access to information, systems, and devices. A breach can significantly impact organizations and individuals in a variety of ways, such as the destruction of systems, changes to data, or, even worse, data theft. Understanding how threats impact an organization helps cybersecurity professionals to better defend their environments.
Threat intelligence is meant to help cybersecurity professionals and executives make decisions about threats that may affect them. Threat intelligence companies collect, process, and analyze information about a threat actor’s tactics, techniques, and procedures (TTPs). This analysis is then disseminated to customers and partners for use within their threat management programs. This data is shared via Information Sharing and Analysis Centers (ISACs) and Information Sharing and Analysis Organizations (ISAOs), government agencies such as the U.S. Cybersecurity and Infrastructure Security Agency (CISA), security vendors such as Unit 42 and Recorded Future, and open-source intelligence tools such as MISP (which formerly stood for the Malware Information Sharing Project).
Sharing threat intelligence with peer organizations is vital to protecting the infrastructure. This information allows security teams to reduce the time it takes to investigate issues and incidents discovered in their environments. This is also an excellent way to stay abreast of emerging technology concerns regarding the Internet of Things (IoT), artificial intelligence (AI), and some aspects of the cloud. While information sharing is essential for collective security, it also presents specific challenges. For example, organizations might be reluctant to share data from a breach due to concerns about reputational damage, fearing that disclosing such incidents could tarnish their image. Additionally, there is a risk of data becoming stale and no longer relevant over time, which can hinder the effectiveness of shared threat intelligence. However, the more we share, the better prepared we are for a security breach.