Managing Information Security Risk: Organization, Mission, and Information System View
CHAPTER THREE > 3.2 ASSESSING RISK > TASK 2-1: Identify threats to and vulnerabilities in organizational information systems and the environments

TASK 2-1: Identify threats to and vulnerabilities in organizational information systems and the environments

in which the systems operate.
Supplemental Guidance: Threat identification requires an examination of threat sources and events. For examining
threat sources and events, organizations identify threat capabilities, intentions, and targeting information from all
available sources. Organizations can leverage a number of sources for threat information at strategic or tactical levels.
Threat information generated at any tier can be used to inform or refine the risk-related activities in any other tier. For
example, specific threats (i.e., tactics, techniques, and procedures) identified during Tier 1 threat assessments may
directly affect mission/business process and architectural design decisions at Tier 2. Specific threat information
generated at Tiers 2 and 3 can be used by organizations to refine threat information generated during initial threat
assessments carried out at Tier 1.
Vulnerability identification occurs at all tiers. Vulnerabilities related to organizational governance (e.g., inconsistent
decisions about the relative priorities of mission/business processes, selection of incompatible implementations of
security controls) as well as vulnerabilities related to external dependencies (e.g., electrical power, supply chain,
telecommunications), are most effectively identified at Tier 1. However, most vulnerability identification occurs at
Tiers 2 and 3. At Tier 2, process and architecture-related vulnerabilities (e.g., exploitable weaknesses or deficiencies in
mission/business processes, enterprise /information security architectures including embedded information security
architectures) are more likely to be identified. At Tier 3, information system vulnerabilities are the primary focus.
These vulnerabilities are commonly found in the hardware, software, and firmware components of information systems
or in the environments in which the systems operate. Other areas of potential vulnerabilities include vulnerabilities
associated with the definition, application/implementation, and monitoring of processes, procedures and services
related to management, operational, and technical aspects of information security. Vulnerabilities associated with
architectural design and mission/business processes can have a greater impact on the ability of organizations to
successfully carry out missions and business functions due to the potential impact across multiple information systems
and mission environments. The refined vulnerability assessments conducted at Tiers 2 and 3 are shared with
organizational personnel responsible for assessing risks more strategically. Vulnerability assessments conducted at Tier
2 and Tier 3 have the opportunity to evaluate additional related variables such as location, proximity to other high risk
assets (physical or logical), and resource considerations related to operational environments. Information specific to
operational environments allows for more useful and actionable assessment results. Vulnerability identification can be
accomplished at a per-individual weakness/deficiency level or at a root-cause level. When selecting between
approaches, organizations consider whether the overall objective is identifying each specific instance or symptom of a
problem or understanding the underlying root causes of problems. Understanding specific exploitable weaknesses or
deficiencies is helpful when problems are first identified or when quick fixes are required. This specific understanding
also provides organizations with necessary sources of information for eventually diagnosing potential root causes of
problems, especially those problems that are systemic in nature.
Organizations with more established enterprise architectures (including embedded information security architectures)
and mature life cycle processes have outputs that can be used to inform risk assessment processes. Risk assumptions,
constraints, tolerances, priorities, and trade-offs used for developing enterprise architectures and embedded information
security architectures can be useful sources of information for initial risk assessment activities. Risk assessments
conducted to support the development of segment or solution architectures may also serve as information sources for
the identification of threats and vulnerabilities. Another factor influencing threat and vulnerability identification is
organizational culture. Organizations that promote free and open communications and non-retribution for sharing
adverse information tend to foster greater openness from individuals working within those organizations. Frequently,
organizational personnel operating at Tiers 2 and 3 have valuable information and can make meaningful contributions
in the area of threat and vulnerability identification. The culture of organizations influences the willingness of
personnel to communicate potential threat and vulnerability information, which ultimately affects the quality and
quantity of the threats/vulnerabilities identified.
RISK DETERMINATION