Threat (computer security)


In computer security, a threat is a potential negative action or event enabled by a vulnerability that results in an unwanted impact to a computer system or application.
A threat can be either a negative "intentional" event or an "accidental" negative event or otherwise a circumstance, capability, action, or event. A threat actor who is an individual or group that can perform the threat action, such as exploiting a vulnerability to actualise a negative impact. An exploit is a vulnerability that a threat actor used to cause an incident.

Standard definitions

A more comprehensive definition, tied to an Information assurance point of view, can be found in "Federal Information Processing Standards 200, Minimum Security Requirements for Federal Information and Information Systems" by NIST of United States of America
National Information Assurance Glossary defines threat as:
ENISA gives a similar definition:
The Open Group defines threat as:
Factor analysis of information risk defines threat as:
National Information Assurance Training and Education Center gives a more articulated definition of threat:

Phenomenology

The term "threat" relates to some other basic security terms as shown in the following diagram:
A resource can have one or more vulnerabilities that can be exploited by a threat agent in a threat action. The result can potentially compromise the confidentiality, integrity or availability properties of resources of the organization and others involved parties.

The so-called CIA triad is the basis of information security.
The attack can be active when it attempts to alter system resources or affect their operation: so it compromises Integrity or Availability. A "passive attack" attempts to learn or make use of information from the system but does not affect system resources: so it compromises Confidentiality.
OWASP depicts the same phenomenon in slightly different terms: a threat agent through an attack vector exploits a weakness of the system and the related security controls causing a technical impact on an IT resource connected to a business impact.
A set of policies concerned with information security management, the Information security management systems, has been developed to manage, according to risk management principles, the countermeasures in order to accomplish to a security strategy set up following rules and regulations applicable in a country. Countermeasures are also called security controls; when applied to the transmission of information are named security services.
The overall picture represents the risk factors of the risk scenario.
The widespread of computer dependencies and the consequent raising of the consequence of a successful attack, led to a new term cyberwarfare.
Nowadays the many real attacks exploit Psychology at least as much as technology. Phishing and Pretexting and other methods are called social engineering techniques. The Web 2.0 applications, specifically Social network services, can be a mean to get in touch with people in charge of system administration or even system security, inducing them to reveal sensitive information. One famous case is Robin Sage.
The most widespread documentation on computer insecurity is about technical threats such as a computer virus, trojan and other malware, but a serious study to apply cost effective countermeasures can only be conducted following a rigorous IT risk analysis in the framework of an ISMS: a pure technical approach will let out the psychological attacks that are increasing threats.

Threats classification

Threats can be classified according to their type and origin:
  • Types of threats:
  • * Physical damage: fire, water, pollution
  • * Natural events: climatic, seismic, volcanic
  • * Loss of essential services: electrical power, air conditioning, telecommunication
  • * Compromise of information: eavesdropping, theft of media, retrieval of discarded materials
  • * Technical failures: equipment, software, capacity saturation
  • * Compromise of functions: error in use, abuse of rights, denial of actions
Note that a threat type can have multiple origins.
  • Deliberate: aiming at information asset
  • * spying
  • * illegal processing of data
  • Accidental
  • * equipment failure
  • * software failure
  • Environmental
  • * natural event
  • * loss of power supply
  • Negligence: Known but neglected factors, compromising the network safety and sustainability

    Threats Trends

Recent trends in computer threats show an increase in ransomware attacks, supply chain attacks, and fileless malware. Ransomware attacks involve the encryption of a victim's files and a demand for payment to restore access. Supply chain attacks target the weakest links in a supply chain to gain access to high-value targets. Fileless malware attacks use techniques that allow malware to run in memory, making it difficult to detect.

Common Threats

Below are the few common emerging threats:
  •      Computer viruses
  •      Trojan horses
  •      Worms
  •      Rootkits
  •      Spyware
  •      Adware
  •      Ransomware
  •      Fileless malware

    Threat classification

published a mnemonic, STRIDE, from the initials of threat groups:
  • Spoofing of user identity
  • Tampering
  • Repudiation
  • Information disclosure
  • Denial of Service
  • Elevation of privilege
Microsoft previously rated the risk of security threats using five categories in a classification called DREAD: Risk assessment model. The model is considered obsolete by Microsoft.
The categories were:
  • Damage – how bad would an attack be?
  • Reproducibility – how easy it is to reproduce the attack?
  • Exploitability – how much work is it to launch the attack?
  • Affected users – how many people will be impacted?
  • Discoverability – how easy it is to discover the threat?
The DREAD name comes from the initials of the five categories listed.
The spread over a network of threats can lead to dangerous situations. In military and civil fields, threat level has been defined: for example INFOCON is a threat level used by the US. Leading antivirus software vendors publish global threat level on their websites.

Associated terms

Threat agents or actors

The term Threat Agent is used to indicate an individual or group that can manifest a threat. It is fundamental to identify who would want to exploit the assets of a company, and how they might use them against the company.
Individuals within a threat population; Practically anyone and anything can, under the right circumstances, be a threat agent – the well-intentioned, but inept, computer operator who trashes a daily batch job by typing the wrong command, the regulator performing an audit, or the squirrel that chews through a data cable.

Threat agents can take one or more of the following actions against an asset:
  • Access – simple unauthorized access
  • Misuse – unauthorized use of assets
  • Disclose – the threat agent illicitly discloses sensitive information
  • Modify – unauthorized changes to an asset
  • Deny access – includes destruction, theft of a non-data asset, etc.
Each of these actions affects different assets differently, which drives the degree and nature of loss. For example, the potential for productivity loss resulting from a destroyed or stolen asset depends upon how critical that asset is to the organization's productivity. If a critical asset is simply illicitly accessed, there is no direct productivity loss. Similarly, the destruction of a highly sensitive asset that does not play a critical role in productivity would not directly result in a significant productivity loss. Yet that same asset, if disclosed, can result in significant loss of competitive advantage or reputation, and generate legal costs. The point is that it is the combination of the asset and type of action against the asset that determines the fundamental nature and degree of loss. Which action a threat agent takes will be driven primarily by that agent's motive and the nature of the asset. For example, a threat agent bent on financial gain is less likely to destroy a critical server than they are to steal an easily pawned asset like a laptop.
It is important to separate the concept of the event that a threat agent get in contact with the asset and the event that a threat agent act against the asset.
OWASP collects a list of potential threat agents to prevent system designers, and programmers insert vulnerabilities in the software.
Threat Agent = Capabilities + Intentions + Past Activities
These individuals and groups can be classified as follows:
  • Non-Target Specific: Non-Target Specific Threat Agents are computer viruses, worms, trojans and logic bombs.
  • Employees: Staff, contractors, operational/maintenance personnel, or security guards who are annoyed with the company.
  • Organized Crime and Criminals: Criminals target information that is of value to them, such as bank accounts, credit cards or intellectual property that can be converted into money. Criminals will often make use of insiders to help them.
  • Corporations: Corporations are engaged in offensive information warfare or competitive intelligence. Partners and competitors come under this category.
  • Human, Unintentional: Accidents, carelessness.
  • Human, Intentional: Insider, outsider.
  • Natural: Flood, fire, lightning, meteor, earthquakes.

    Threat source

Threat sources are those who wish a compromise to occur. It is a term used to distinguish them from threat agents/actors who are those who carry out the attack and who may be commissioned or persuaded by the threat source to knowingly or unknowingly carry out the attack.