When doing Risk Assessment of a threat, how can I find the best threat agent for the risk assessment?
For example, the asset which has the vulnerability related to the threat may be in an internal network behind a DMZ.
In this case, some of the possible threat agents I can think of for analyzing the risk of this threat are:
- Criminal hackers (External)
- Criminal Organizations (External)
- Insider Employee
- Insider Operational Employee (Sysadmin/Developer)
- etc...
If the vulnerability of my asset can be accessed only by local network, I have to assume that the first two threat agents have somehow broken the security of the internal networks to gain the access to the local network.
But for the Insider Employee and Insider Operational Employee, I do not have to assume that they have to exploit another vulnerability/ies to gain the access to the local network to gain the access to the vulnerability of my asset. They do not need to have any prerequisites to do the attack, like external attackers.
So on the one hand, it seems to me that it is better to consider the threat agent which does not need to do any prerequisite step for assessing the risk of this threat.
But this is the first time I am trying to a risk assessment. Therefore I am not sure what is correct. So, I would appreciate any guidance on the right direction.