0

There are many risk assessment guidelines such NIST800-30 and ISO 27005 that provide a catalogue of known threats as reference. Using a qualitative approach, I selected one threat events catalogue and I tried to select the threats that are applicable to my use case.

To my understanding, by studying the system design specifications, I can compile a list of threats that may affect the system. However, I want to be more deterministic in my approach and say if the system is vulnerable to my compiled threats or not.

My approach is to look at the current security controls deployed on the system, and by analysing these controls I can say "System is vulnerable to threat X, Y and Z". I know I kind of have an answer to my question, but maybe there is a more methodological / organized approach? Having a list of known threats, how can I determine if a system is vulnerable or not?

PS: I am more interested on a qualitative approach, I know a vulnerability tool can make life easier.

schroeder
  • 123,438
  • 55
  • 284
  • 319
NoRel
  • 1
  • 5

1 Answers1

1

You are asking about a pure risk assessment methodology. And it's quite simple at a high level.

  • what are the inherent, relevant risks in the context (vulnerabilities matched with threats)?
  • what controls are in place to address those risks?
  • how effective are those controls against those risks?
  • what's left that is unaddressed?

Threat catalogues are meant to help inspire thoughts to come up with a list of relevant risks in context. They are not meant to be a complete list.

Vulnerability tools look at technical risks that are discoverable through technical analysis. There is a whole universe of risk that is outside of technical vulnerabilities.

schroeder
  • 123,438
  • 55
  • 284
  • 319
  • Thank you for your answer @schroeder and I agree with you about the purpose of threat catalogues. How can I evaluate the effectiveness of the existing controls? – NoRel Oct 27 '21 at 12:20
  • You said you wanted a qualitative assessment. You determine the scale you want and assess based on that scale. H/M/L, Primary/Secondary/Tertiary control, etc. – schroeder Oct 27 '21 at 13:56