Why Threat Agents Must be Included in Cybersecurity Risk Assessments

You may be missing an important aspect to your risk assessments that greatly limits your ability to efficiently allocate resources for the very best cybersecurity outcomes. One of the biggest challenges for cybersecurity leadership is determining how best to allocate limited resources to maximize your defensive posture. Nobody ever has enough, and unfortunately, if we dedicate efforts to areas that aren't at risk, we short the areas which will be attacked, and that is inefficient. It is a zero-sum game where prioritization drives how and where we bolster our defenses. This is why you need to be including threat agents into your cybersecurity risk assessments. Most are doing it wrong. Now, the origins of every cyberattack begins with a person, living, breathing person. They're the attacker. And it might be a malware writer, a cybercriminal, a disgruntled employee, or any number of other different archetypes. What's important is which attackers are relevant to your organization and how to prioritize controls that target their collective preferred methods of attack. Here is the key: not all threat agent personas are interested in you, which means there are attack methods that are not likely for your organization. Adjusting your protection strategy to focus on the most likely areas of attack greatly optimizes your effectiveness. As Frederick the Great said, "He who defends everything defends nothing." So stop blindly trying to fix everything. By incorporating threat agent archetypes, you can uplevel your risk assessment to know who is attacking you, their capabilities, what specifically they are targeting, and their preferred tactics. That enables you to arrange the best defense possible for the adversaries that you face. Let me walk you through this at a really high level, and let me know in the comments if you want a more detailed process overview, and be sure to like this video. Cyber threat agents are the people behind the attacks. They use tools and tactics to get what they want, but we must better understand our enemy if we're to prevail. Sun Tzu advocated this more than 2,000 years ago. The actions of attackers are driven by their base motivations, which direct the creation of their objectives. For example, cybercriminals are motivated by personal financial gain. And they have objectives to steal valuables or commit extortion in the pursuit of money. Attackers are enabled by their resources that they have available to them and are restricted by certain limitations, thus defining their overall capabilities. An example, nation-states, well, they possess massive technology and human resources and talent and skills and are open to causing significant harm in pursuit of their national agenda. Data miners, on the other hand, have limited resources and often don't want to do any more than gently fracture existing laws and certainly not directly hurt anyone as they collect data. Objectives and capabilities, those two things combined, That determines the targeting of victims and for specific assets. Cybercriminals pursue those with valuables or that are likely to pay digital extortion. Kind of makes sense. Attackers have preferred methods based upon these factors, which are often used as part of their attack. Every persona has a favorite set of methods or tools or tactics as they pursue their objectives. Social engineering is a common among many, uh, threat agents. Insiders use credentials that they were bestowed with when they joined the organization. While hardware and API manipulation are more uncommon, and only used by a handful of attacker types. So again, we can see how everybody's a little bit different. Now, cyber threat agents can be grouped into personas, also known as threat agent archetypes, based on all these different common attributes. So they all break down and fall into one of these archetypes. And this provides keen intelligence when we look at what is being targeted targeted and the methods that will be employed. This is why threat agent archetypes play such a key role in cybersecurity risk assessment and resource allocation prioritization. If we understand the archetypes, then we can deprioritize the personas which are likely not very interested in our organization as it doesn't satisfy their objectives. Mapping the methods of those attackers, then we have the insights to which attacks are going to be most likely, most relevant to us. We understand the most relevant attack methods, and the result is that we can reduce focus on some areas while raising the priorities of others. And again, that's key to resource allocation management, to being effective and efficient. And in doing so, we can then apply the technology, process, and behavioral controls to the most critical areas, specifically to improve the prevention, improve the rapid detection, and make for efficient recovery of the likely attacks, and that is extremely powerful. The process is not that difficult and can greatly augment current risk assessment methods. This doesn't need to replace what you're using now. This can add a better set of clarity into what you're already tracking. It starts with understanding the various threat agent archetypes, which specifies the motivations, objectives, resources, capabilities, and limitations. And there are many sources you can use. I like the Threat Agent Library, which has been around for many years, and I actually maintain a custom updated version for all of my risk assessment work. If there's enough interest, I'm happy to clean up my spreadsheet and make it available to everyone. Let me know in the comments. And if you like cybersecurity leadership content like this, Be sure to follow me on LinkedIn, Substack, and my Cybersecurity Insights YouTube channel. The links will be in the description.