/
Tech-study-notes

On this page

Threat Profiling

Overview

Threat profiling is a strategic approach to cybersecurity that focuses on understanding which threats are most relevant to your specific organization. Rather than attempting to defend against every possible threat, this framework helps prioritize resources by identifying:

Understanding Risk in Context

Risk Components

Risk in both traditional IT and industrial control systems (ICS/OT) consists of three core elements:

ComponentDescription
ThreatsActors with capability and intent to cause harm
VulnerabilitiesWeaknesses that can be exploited (e.g., Log4j)
Impact/ConsequencesFinancial loss, operational disruption, or loss of life

Resilience in Operational Technology

In OT (Operational Technology) environments, resilience takes on additional meaning beyond IT:

Key Insight: No amount of cybersecurity can prevent a pipe from breaking at 1000 PSI. Physical engineering controls remain essential.

The Value of Human Life in Risk Calculations

The U.S. government values human life at approximately $7 million per person for workplace accident calculations. While morbid, this metric enables quantitative risk assessment when evaluating safety investments.

The Diamond Model of Threat Analysis

Developed by Sergio Caltagirone (now VP at Dragos), the Diamond Model provides a framework for categorizing threats using four interconnected components:

                    ┌─────────────────┐
                    │   ADVERSARY     │
                    │   (Who)         │
                    └────────┬────────┘
                             │
            Social/Political │ Technological
                    │        │        │
                    ▼        ▼        ▼
            ┌─────────────────────────────┐
            │         VICTIM              │
            │   (Why am I targeted?)      │
            └─────────────┬───────────────┘
                          │
                    ┌─────┴─────┐
                    ▼           ▼
            ┌──────────┐  ┌──────────┐
            │CAPABILITY│  │INFRASTRUCTURE│
            │  (How)   │  │   (What)     │
            └──────────┘  └──────────────┘

The Four Components

  1. Adversary: The threat actor (nation-state, criminal group, insider, hacktivist)
  2. Victim: The target organization and its attributes
  3. Capability: The tools, techniques, and procedures (TTPs) available to the adversary
  4. Infrastructure: The systems and networks that must be compromised

Key Relationships

Important: When analyzing threat groups (like APT-31), you typically understand three of the four components. The missing piece creates the “triangle” rather than complete diamond.

Organizational Breakdown for Threat Assessment

To properly assess threats, you must first understand your own organization through an adversarial lens. This requires a tiered approach:

Tier 1: System Owner

Definition: The primary organization for which you’re creating the threat profile.

Attributes to Consider:

Example: A publicly traded small-cap oil and gas company has different threat considerations than a private manufacturing facility.

Tier 2: Critical System/Subsystem

Definition: The collection of assets, networks, or specific systems requiring protection.

Considerations:

Tier 3: Critical Function

Definition: The principal task your system performs.

Examples:

Tier 4: Components

Definition: The hardware and software enabling critical functions.

Examples for a Pipeline:

Tier 5: Controllers

Definition: Assets with the ability to manipulate the environment or exercise significant authority.

In OT Environments:

In IT Environments:

Key Point: Controllers represent where cyber commands become physical actions or where administrative access enables system-wide control.

Tier 6: Crown Jewels

Definition: The subset of components that, if compromised, cause catastrophic impact.

Characteristics:

Pipeline Crown Jewels Example:

  1. RTUs: Wireless control of remote compressor stations
  2. Leak Detection Systems: EPA-mandated shutdown triggers
  3. SCADA Systems: Valve and pump control
  4. Engineering Workstations: The Windows desktops used to control all above systems

Critical Insight: Engineering workstations often run outdated operating systems (Windows XP, Windows 7, Server 2008/2012) but provide the primary interface for controlling crown jewel systems.

Practical Application: Oil & Gas Pipeline Example

Organization Profile: “ACME Oil & Gas”

System Owner Attributes:

Critical Function:

Key Components:

Controllers:

Crown Jewels:

  1. RTUs controlling compressor stations (1100+ miles away)
  2. Leak detection systems (EPA shutdown mandate)
  3. SCADA control systems
  4. Engineering workstations (single point of control)

Threat Capability Assessment

Understanding Adversary Sophistication

Not every organization faces the same threat landscape. MITRE ATT&CK and CISA provide frameworks for assessing threat capabilities:

Capability Levels:

LevelCharacteristicsExamples
AdvancedNation-state, zero-day exploits, custom toolsAPT groups, intelligence services
IntermediateWeaponized exploits, commercial tools, trainingCriminal organizations, skilled hacktivists
BasicKnown exploits, open-source tools, limited resourcesScript kiddies, unsophisticated criminals

Matching Threats to Your Profile

Questions to Ask:

  1. Are you critical infrastructure?
  2. Do you handle sensitive government data?
  3. Are you a high-value financial target?
  4. Do you have geopolitical significance?
  5. Are you vulnerable to insider threats?

Example Threats by Organization Type:

OrganizationPrimary Threats
Small RetailOpportunistic ransomware, credit card theft
Critical InfrastructureNation-states, advanced persistent threats
HealthcareRansomware, data theft, insider threats
ManufacturingIP theft, industrial espionage, ransomware

Identifying Critical Assets: The “Bad Day” Exercise

Methodology

To identify crown jewels, ask stakeholders: “What does a bad day look like?”

Who to Ask:

What to Look For:

Real-World Example: Manufacturing

Scenario: Elmer’s Glue Production

Perspective Differences:

Key Insight: Different stakeholders describe the same failure using different language, but they’re identifying the same critical asset.

Implementing the Framework

Step-by-Step Process

Phase 1: Self-Assessment

  1. Define your organization (system owner)
  2. Identify all critical systems and business functions
  3. Map components for each critical function
  4. Identify controllers and crown jewels
  5. Document minimum operating conditions

Phase 2: Threat Intelligence Integration

  1. Subscribe to relevant threat feeds (US-CERT, CISA)
  2. Filter vulnerabilities by your crown jewels
  3. Assess threat actor capabilities against your defenses
  4. Prioritize based on relevance, not just CVSS scores

Phase 3: Control Implementation

  1. Build security controls around crown jewels first
  2. Work outward to less critical systems
  3. Implement defense-in-depth strategies
  4. Plan for resilience and rapid recovery

Cost-Benefit Analysis

C-Suite Perspective: “Can we achieve acceptable risk with minimum spend?”

Security Response:

Key Takeaways

Core Principles

  1. Not All Threats Apply to Everyone

    • Nation-states don’t target small manufacturers of office supplies
    • Match your defenses to realistic threat actors

  2. Know Yourself Better Than Attackers Do

    • Adversaries research your organization extensively
    • Understanding your own crown jewels is foundational

  3. Prioritize Based on Impact

    • Identify minimum operating conditions
    • Build security outward from crown jewels
    • Accept that you cannot protect everything equally

  4. Context Matters

    • CVSS scores don’t tell the complete story
    • An authenticated vulnerability on a controller may be less critical than unauthenticated access to a monitoring system
    • Consider exploitability, exposure, and business impact

  5. Threat Landscapes Evolve

    • Mergers, acquisitions, and expansions change your profile
    • Media attention can elevate threat levels
    • Geopolitical events shift targeting priorities

Practical Metrics

References and Further Reading

Summary Checklist

When building your organization’s threat profile, ensure you can answer: