TAZ Forum Community

Hi

Apart from identifying the assets and their values,
the starting point for such a risk assessment is
what we call the threat agent: hurricanes, floods, fire,
virus, intruder, ..., (spammer, employee, ...)

Then, vulnerabilities for each threat agent are defined,
like thatched roof, lack of antivirus software, lack of entry-control, ...

As a result, you may define threats, like uncontrollable fire,
virus infection, stolen devices or 'secrets', ...


Then you continue with probabilities, impacts, countermeasures, ...
as you know it.


One source of confusion I have seen is the "difference"
between threat agents and threats. Often, these are
used as synonyms, which leads to confusion. At least from a
computer security perspective, a threat agents exploits a
vulnerability to realise a threat.

Good luck

Cheers

Cheers Sec, this stuff does my head in sometimes