External threats represent the adversarial dimension of the security risk landscape that the Security Consulting function must address with the current threat intelligence, the architectural defence, and the operational capability that the sophisticated and continuously evolving external adversary’s targeting of the organisation demands. The external threat landscape has matured significantly beyond the opportunistic malware distribution and the automated vulnerability scanning that represented the primary external threat categories of the previous decade, encompassing the highly targeted advanced persistent threat campaigns of nation-state actors, the industrialised ransomware operations of organised criminal networks, and the supply chain compromise techniques whose sophistication makes the trusted relationship between the organisation and its vendors the attack vector rather than the security boundary the relationship appears to represent.
The Security Consulting function must govern the external threat advisory with the threat intelligence currency that connects the advisory’s recommendations to the actual techniques being deployed against organisations with the comparable profile, sector, and geography rather than the generic threat landscape that the security vendor’s marketing materials describe without the organisation-specific intelligence that makes the advisory relevant to the specific adversarial attention the organisation faces. The advisory that recommends the defences most appropriate for the threat actors most likely to target the organisation based on the intelligence about their motivations, capabilities, and preferred techniques will produce the security investment allocation that the organisation’s actual threat exposure justifies rather than the comprehensive defence against all possible threats that the risk-agnostic approach would recommend without the prioritisation that the security investment’s finite resource demands.
Understanding the External Threat Landscape #
The external threat categories that the Security Consulting function must advise on with the current intelligence whose specificity makes the advisory actionable rather than generic encompass the principal adversarial approaches whose prevalence and impact the organisation’s risk profile requires the security architecture to address:
Keep reading with a free Eristotle account.
Every document across our Bodies of Knowledge is free to read once you are signed in. No payment, no tier.
