1 Foundations of Threat Analysis Free Online FlashCards

What is threat analysis?

Threat analysis is the structured examination of possible or ongoing malicious activity to support informed decisions about detection, response, and risk reduction.

What is the first step in the threat-analysis lifecycle?

Set the question and scope: identify the decision the analysis must support.

What kinds of material can cyber threat information include?

It can include indicators, adversary behavior, vulnerabilities, and suggested defensive actions.

What is a threat actor?

A threat actor is an individual or group that poses a threat; the actor may be external or an insider, and their identity or motive may be unknown.

What is an indicator of compromise (IOC)?

An IOC is a technical artifact or observable suggesting that an attack is imminent, underway, or may have occurred.

What factors should guide mitigation priorities?

Prioritize according to the importance of affected assets, the plausibility of exploitation, and potential impact—not merely because a threat report or indicator exists.

What does processing and validating threat information involve?

Organize and correlate information, check its source and freshness, and distinguish confirmed observations from assumptions.

What does a tactic describe?

A tactic is an adversary’s high-level goal: the why behind an action.

What does a technique describe?

A technique is a general method used to pursue a goal: the how.

What is a procedure in adversary behavior?

A procedure is the specific way an actor carries out a technique in a particular operation.

What makes an event an attack?

An attack is an attempt to gain unauthorized access or compromise confidentiality, integrity, or availability. It is an event or operation, not an actor’s identity or a weakness.

What is a vulnerability?

A vulnerability is a weakness in a system, its implementation, or its security procedures that could be exploited or triggered by a threat source.