Threat Modeling and Internetworking

Before diving into threat modeling in an internetworking context, let's first distinguish between two broad classes of the things that can go wrong with one's networks:

• Hazards are events not deliberately caused by an actor or agent that have the potential for inflicting damage or disruption to an organization's information or information systems. Hazards can be caused by corrosion, wear and tear, or weather damage. Accidents, utility power interruptions, fire, and smoke are other examples of hazards. Mechanical or other systems damaged by errors or accidents during

installation and maintenance are also hazards, not threats.

• Threats are the deliberate actions taken by an actor or agent with the intention and purpose of causing disruption or damage to an organization's information or information systems. Threats include both inappropriate or malicious damage or disruption.

The key distinction here, of course, is intent. Threats are carried out by conducting attacks. Mother Nature or an earthquake do not attack your systems. Hazards can and should be anticipated by systems safety and support planning. Threats are dealt with by the systems security functions. These two processes have points in common, but they have significantly different purposes and agendas.