Threats to information systems come in many flavors, some with malicious intent, others with
supernatural powers or unexpected surprises. Threats can be deliberate acts of espionage,
information extortion, or sabotage, as inmany targeted attacks between foreign nations; however,
more often than not it happens that the biggest threats can be forces of nature (hurricane, flood) or
acts of human error or failure. It is easy to become consumed in attempting to anticipate and
mitigate every threat, but this is simply not possible. Threat agents are threats only when they
are provided the opportunity to take advantage of a vulnerability, and ultimately there is no
guarantee that the vulnerability will be exploited. Therefore, determining which threats are
important can only be done in the context of your organization. The process by which a threat can
actually cause damage to your information assets is as follows: A threat agent gives rise to a
threat that exploits a vulnerability and can lead to a security risk that can damage your assets and
cause an exposure. This can be countermeasured by a safeguard that directly affects the threat
agent. Figure 1.4 shows the building blocks of the threat process.