The approximate document size is in bold for text files. A short abstract follows each entry. Documents marked with a are recommended reading. Register for E-mail updates .
Few organizations invest in proper risk assessments before implementing controls.
Even fewer have the capability to understand and qualify threats to their information assets in order to accurately assess risk. Furthermore, when considering risks to information infrastructures, the number, type and variation of threats are overwhelming. This paper discusses threat assessments and information infrastructures in general, how they relate to risk assessments and provides an overview of a new model for threat assessment. This model identifies potential threats to networks and information infrastructures which cross organizational and national boundaries where no single entity, governmental or private, has control or responsibility to protect and secure information and applications. Vulnerabilities are identified in a systematic way by analyzing specific threat enablers.