Sources of Risk
These are the various sources that cause a risk event to occur.
Internal vs External Sources
Internal sources are within the trust and control boundary of the organisation whereas External sources exist outside the trust and control boundary of the organisation.
Malicious vs Non-Malicious
Malicious sources are those with intent to cause harm whereas Non-Malicious sources do not have intent to cause harm.
It can be useful to consider characteristics of each source when analysing risks, the following charcteristics can be useful to bear in mind:
- Goals (Curiosity, Personal Fame, Personal Gain, National Interests, Revenge, etc)
- Skills (No technical skills, End user, Power user, Developer, Researcher)
- Knowledge (External to organisation, Ex-Organisation insider, Organisation partner, Customer, Employee, Other insider)
- Opportunity (Connected to Internet, Physically nearby, Access to connected partner, Access to organisation, Access to specific network / system)
- Deterrability (Unconcerned criminal, Careful criminal, Careless law-abiding, Careful law-abiding)