insiders to help them. Corporations: Corporations are engaged in offensive information warfare or competitive intelligence. Partners and competitors come under this category. Human, Unintentional: Accidents, carelessness. Human, Intentional: Insider, outsider. Natural: Flood, fire, lightning, meteor, earthquakes. Threat source Threat sources are those who wish a compromise to occur. It is a term used to distinguish them from threat agents/actors who are those who carry out the attack and who may be commissioned or persuaded by the threat source to knowingly or unknowingly carry out the attack. Threat communities Threat communities Subsets of the overall threat agent population that share key characteristics. The notion of threat communities is a powerful tool for understanding who and what we’re up against as we try to manage risk. For example, the probability that an organization would be subject to an attack from the terrorist threat community would depend in large part on the characteristics of your organization relative to the motives, intents, and capabilities of the terrorists. Is the organization closely affiliated with ideology that conflicts with known, active terrorist groups? Does the organization represent a high profile, high impact target? Is the organization a soft target? How does the organization compare with other potential targets? If the organization were to come under attack, what components of the organization would be likely targets? For example, how likely is it that terrorists would target the company information or systems? The following threat communities are examples of the human malicious threat landscape many organizations face: Internal Employees Contractors (and vendors) Partners External Cyber-criminals (professional hackers) Spies Non-professional hackers Activists Nation-state intelligence services (e.g., counterparts to the CIA, etc.) Malware (virus/worm/etc.) authors Threat action Threat action is an assault on system security. A complete security architecture deals with both intentional acts (i.e. attacks) and accidental events. Various kinds of threat actions are defined as subentries under "threat consequence". Threat analysis Threat analysis is the analysis of the probability of occurrences and consequences of damaging actions to a system. It is the basis of risk analysis. Threat consequence Threat consequence is a security violation that results from a threat action. Includes disclosure, deception, disruption, and usurpation. The following subentries describe four kinds of threat consequences, and also list and describe the kinds of threat actions that cause each consequence. Threat actions that are accidental events are marked by "*". "Unauthorized disclosure" (a threat consequence) A circumstance or event