2

As @ConorMancone says, there's no reason it can't fall under both categories. When a hurricane takes down power lines and imposes a power outage, that's an environmental threat. When the power supply company lacks sufficient capacity and inflicts brownouts and blackouts on its customers, that's a structural threat. (Peabody, I'm looking at you). These both ...


2

Quantifying based on the formula There is a massive misunderstanding in risk in general, and you are running into this misunderstanding. That's not a formula! Risk = Threat x Vulnerability x Information Value describes a relationship between those factors. You are not supposed to drop numbers in there and come out with a quantitative result. Note that there ...


1

In my opinion it depends on what kind of damage you are referring to. The damage must be caused directly by the threat (or directly enough, at least), otherwise you end up with chains of causes and effects, leading to surreal conclusions. For example, if you have an office by the road, and a dog crosses the road, and a truck steers to avoid the dog, and the ...


1

There is no answer possible. Many struggle with this and almost nowhere it actually works. The point about component owners is perhaps the most important one. Every component must have a component owner. When people leave, someone else needs to pick that up (this is actually hard). In my experience, some form of hierarchy in the components (not necessarily ...


1

You are not using a useful risk assessment process, which is why you are having trouble coming up with a measure. Importance of Inherent Risk You are combining likelihood and impact with the mitigations (people, controls, policies, etc.). A risk assessment first assesses the risk without mitigations. This gives you your inherent risk. Sometimes you can ...


1

I think this might be of your interest "DeTT&CT aims to assist blue teams using ATT&CK to score and compare data log source quality, visibility coverage, detection coverage and threat actor behaviours. All of which can help, in different ways, to get more resilient against attacks targeting your organisation. The DeTT&CT framework consists ...


Only top voted, non community-wiki answers of a minimum length are eligible