o. Threats • A threat is a potential event that can take advantage of a vulnerabilities (weaknesses in systems, networks and devices) and cause a negative impact on the network, system, or organization. A threat is the possible event, while an attack is the incidence of such an event. Threats can be accidental or intentional. Accidental threats do not have premeditated intent. Examples are potential system or software malfunctions, misconfigurations, or accidental disclosure of sensitive or private information. Intentional threats are possible deliberate acts against the security of an asset. Intentional threats range from potential casual examination of a computer network using easily available monitoring tools, to sophisticated deliberate attacks using special system knowledge. • Threats to the network need to be identified, and the related vulnerabilities need to be addressed to minimize the risk of the threats. The major cyber threats are malware, web-based attacks, web application attacks, denial of service, phishing, and identity theft. Insider threats are just as dangerous as those coming from outside the network. p. Threat Agents • It is customary to use the term attacker to refer to any individual attacking a computer system. “Threat agent” is a more inclusive term, referring to individuals who are attacking or have attacked a network, system or organization, alongside those who would capitalize upon a vulnerability (either intentionally or accidentally) and cause a negative impact upon the network, system or organization. • Risk assessment techniques require that a threat assessment be performed to identify the threats a system faces, and the actors or the sources behind them. Though it is possible to identify a threat and the corresponding attack vectors employed, identifying the threat agent is not straightforward. Collecting and analyzing event logs through specialized systems such as Intrusion Detection System (IDS) or even Security Information and Event Management (SIEM) systems could easily reveal the attempted or successful threats that took place, but threat agent identification and analyzing their attributes requires further investigation and expertise beyond the scope of a pure cyber security domain. Threat agent identification should also encompass attributes such as motivation, capability, opportunity exploited, and potential impact to the target system. Log analysis is a useful and necessary approach, but it can be challenging to find the important information hidden in very large amounts of collected data. The logs themselves can also be used by attackers to obtain important information about the network and its defenses, and this means the logs must be protected as well. • The major threat agents are insider threats, malicious attackers and hacktivists, cyber criminals, cyber spies, and cyber terrorists. Any of these may be independent, or may be acting for or on behalf of nations (e.g. national security agencies, military, law enforcement) or commercial entities (in the case of industrial espionage or attacks). q. Vulnerabilities • Vulnerabilities are the weaknesses in systems, networks and devices that can be potentially exploited by threat agents to carry out an attack. Vulnerabilities can be present in communication protocols, operating systems and application software running on devices that connect to networks including routers, switches, servers, user devices, and even security devices themselves. Vulnerabilities may be introduced by poor configuration and persist due to lack of software patching. • In general, network systems may have one or all of the following vulnerabilities or weaknesses: • Inherent technological weaknesses, or bugs • Configuration weaknesses • Security policy weaknesses • Insufficient end user training, end user carelessness and intentional end user acts. internetsociety.org Internet Infrastructure Security Guidelines for Africa 29