Threat landscape

As explained in Azure Security

The overall set of vulnerabilities, malicious software, and adversary groups that shape an organization's cyber threat environment.

A threat landscape is the set of vulnerabilities, malware, and bad-actor groups affecting an organization. Vulnerabilities create gaps in security controls that attackers can exploit for financial, political, or other malicious purposes. section 1.4

Analyze hostile activity at several levels:

• Identify bad actors, including malicious insiders and external cyber criminals. section 1.4
• Relate each actor’s goal to tactics, techniques, and procedures: a goal is the intended outcome, a tactic is the broad behavior, a technique adds detail, and a procedure provides the most detail. section 1.4
• Study evolving threats and likely compromise paths to strengthen preventive security controls. section 1.4

Treat security improvement as an iterative cycle: investigate incidents, learn from the findings and relevant breaches or security advice, and apply those lessons to future Azure deployments and security practices. section 1.3

The gym analogy

Like someone observing other people at a gym and adapting useful routines, an organization can study how bad actors behave and use those insights to reduce the likelihood of compromise. section 1.4

Figure 1.1 Improving an organization’s security posture can be seen as an ever-evolving and ever-changing cyclical process.

Use the cyclical-process figure to reinforce that improving security posture requires continuous reassessment rather than a one-time control. section 1.3

How Azure Security covers it

How deep it goes

Defines landscape components and distinguishes goals, tactics, techniques, and procedures without detailing specific attack procedures.

Examples

Uses malicious insiders, cyber criminals, organizational breaches, external security advice, and a gym-training analogy.

What you can do after

Evaluate evolving threats, anticipate compromise paths, and update security practices to reduce the likelihood of compromise.

How it connects

Connects vulnerabilities, malware, bad actors, security controls, security posture, tactics, techniques, and procedures.

liveBookmanning.com

Read Azure Security on liveBook Get the book at manning.com

Related concepts

• hypothesisconfigures · A hypothesis is a provisional proposition, explanation, or prediction that can be evaluated against evidence.
• malicious codehas part · Malicious code is software or executable content intentionally designed to perform unauthorized, harmful, disruptive, deceptive, or security-compromising actions.
• vulnerabilityhas part · A vulnerability is a weakness or susceptibility in a system, process, or person that can expose it to harm, misuse, failure, or compromise.
• threat intelligenceproduced by · Threat intelligence is analyzed, evidence-based knowledge about threats, adversaries, vulnerabilities, attack methods, and indicators that supports security decisions.
• thresholdconfigures · A threshold is a boundary value against which a quantity is compared to determine whether a condition is met or an action or decision is triggered.
• threat actorhas part · A threat actor is a person, group, process, or other entity that intentionally attempts to compromise, misuse, disrupt, or defeat the security of a system or information.

This explainer was generated by Manning's knowledge graph from the text of Azure Security. The section links point to the parts of the book it draws on.