Use of Threat Reports in Information Security Risk Assessments
Tamás Tóth
2023.09.07
In this article, I aim to highlight how to move beyond template-based, compliance-driven risk assessments to create meaningful evaluations of real security threats. This is not an exhaustive guide to risk management methodologies but rather an insight into making risk assessments more valuable by integrating threat intelligence.
The Problem with Template-Driven Assessments
Information security standards like PCI-DSS, ISO 2700x, NIST CSF, and others, all emphasize risk-based approaches. However, the compliance pressure often results in superficial assessments that add little value. To truly protect organizations, risk assessments should prioritize understanding actual threats rather than just ticking compliance checkboxes.
Leveraging Threat Reports
Threat reports provide valuable data that can enhance the quality of risk assessments. Notable examples include ENISA’s Threat Landscape (ETL) and Verizon’s Data Breach Investigation Report (DBIR). The ETL focuses on European trends, while DBIR provides a global perspective, detailing incidents, attack vectors, targeted assets, and motivations of threat actors.
Both reports are also mapped to security standards, with ETL linked to ISO 27001 and DBIR aligned with CIS controls, offering practical guidance to security professionals. These mappings help bridge the gap between identifying threats and applying the appropriate defensive measures.
Practical Application in Risk Assessment
In frameworks like ISO 27005, threat identification forms a key part of the risk identification process. Reports like DBIR offer insights into top attack vectors (e.g., stolen credentials, ransomware, phishing) and targeted assets (e.g., servers, user devices). They help assessors understand the likelihood and impact of specific risks, enhancing the accuracy of their evaluations.
Conclusion
To avoid static and unresponsive assessments, organizations must incorporate current threat intelligence, such as the data from ETL and DBIR, into their processes. Relying solely on standard templates ignores real-world threats that could have significant impacts on both organizations and customers. Using high-quality, cross-verified threat data is essential for meaningful risk management in an evolving cybersecurity landscape.
Read the full article on our International subsidiary’s website by clicking on the image.
Sources