I understand the concept of classifying our data and associating degrees of risk with different classes of data. My question is this - is there a precedent for classifying users the same way? Specifically, is there a standard (like NIST or some other) that suggests classifying users and the risk associated with them the same way as one would with data?
1 Answer
I don't believe there are any common standards which focus upon assigning risk levels to users specifically, but there are certainly elements of this task in almost all risk management methodologies. Primarily, you want to focus upon threat actors and impact sections, as essentially you're looking to produce a risk assessment based on the access a user has, what motivation they might have to be malicious, and what the impact of them compromising data on their systems might be.
Personally, I'd start with the OWASP Risk Rating Methodology, focusing primarily on the threat actor section and technical/business impact factors sections. You should also take a look at the Further Reading section of this article, which should give you plenty of options to choose from for alternative methods of risk classification.
answered Jun 1, 2016 at 19:20
