With this unprecedented connectivity come new risks for the information infrastructure upon which organizations are building their e-businesses. In this environment, the combination of global connectivity, employee mobility and rapid technological change creates new opportunities for fraud, theft, extortion, pirating, industrial espionage and business interruption. Technology is not the only source of risk to information infrastructures. Political, physical, environmental, legal and regulatory issues are all factors contributing to the creation of a multi-dimensional problem. While prevention is the preferred course of action, no security measures are perfect.
Few organizations invest in proper risk assessment before implementing controls.
Even fewer have the capability to understand and qualify specific threats to their information assets in order to assess risks accurately. The consequences can be profound. Not only are some threats overlooked leaving inadequate controls, but also scarce resources and budgets may be misapplied to threats that do not exist or have minimal impact. Furthermore, when considering risks to information infrastructures, the number, type and variation of threats are overwhelming. This paper will discuss threat assessments, risk assessments and information infrastructures in general and provide an overview of an intelligence-base threat assessment model.