- [Narrator] Organizations face many different
kinds of threats and it's often difficult
to keep track of them all and identify
those that pose the greatest risk.
Security professionals use threat modeling techniques
to identify and prioritize threats and assist
in the implementation of security controls.
When identifying potential threats to an organization,
security professionals should use a structured approach.
Don't just sit down and start thinking of all
the things that could go wrong.
It's too easy to leave things out with that type of
haphazard approach to threat identification.
Instead, conduct a structured walk-through
of the potential threats to information and systems.
Let's look at 3 ways that an organization
can use a structured approach to threat identification.
First, an organization can use an asset-focused approach.
In this approach, analysts use the organization's
asset inventory as the basis for their analysis
and walk through, asset by asset identifying
the potential threats to each asset.
For example, when they get to the organization's
web presence, they might identify the severing
of a single fiber-optic cable as a threat
to the continued availability of the website.
Second, an organization can use a threat-focused approach.
Using this method, the organization thinks
of all the possible threats out there and then
thinks through how those threats might affect
different organizational information systems.
For example, analysts might list the threat of a hacker
and then think through all of the ways that a hacker
might try to gain access to their network.
Threats to an organization may include a wide spectrum
of groups ranging from known adversaries to contractors,
trusted partners and even rogue employees.
Finally, an organization can use a service-focused approach.
This is more commonly used by service providers
who offer services over the Internet to other organizations.
For example, an organization that exposes an API
to the public, might think through all
of the interfaces offered by that API
and the threats that could affect each interface.
This identification of all the threats
facing an organization is the first step
in the threat modeling process.