or the squirrel that chews through a data cable. Threat agents can take one or more of the following actions against an asset: Access – simple unauthorized access Misuse – unauthorized use of assets (e.g., identity theft, setting up a porn distribution service on a compromised server, etc.) Disclose – the threat agent illicitly discloses sensitive information Modify – unauthorized changes to an asset Deny access – includes destruction, theft of a non-data asset, etc. It is important to recognize that each of these actions affects different assets differently, which drives the degree and nature of loss. For example, the potential for productivity loss resulting from a destroyed or stolen asset depends upon how critical that asset is to the organization's productivity. If a critical asset is simply illicitly accessed, there is no direct productivity loss. Similarly, the destruction of a highly sensitive asset that does not play a critical role in productivity would not directly result in a significant productivity loss. Yet that same asset, if disclosed, can result in significant loss of competitive advantage or reputation, and generate legal costs. The point is that it is the combination of the asset and type of action against the asset that determines the fundamental nature and degree of loss. Which action(s) a threat agent takes will be driven primarily by that agent's motive (e.g., financial gain, revenge, recreation, etc.) and the nature of the asset. For example, a threat agent bent on financial gain is less likely to destroy a critical server than they are to steal an easily pawned asset like a laptop. It is important to separate the concept of the event that a threat agent get in contact with the asset (even virtually, i.e. through the network) and the event that a threat agent act against the asset. OWASP collects a list of potential threat agents to prevent system designers, and programmers insert vulnerabilities in the software. Threat Agent = Capabilities + Intentions + Past Activities These individuals and groups can be classified as follows: Non-Target Specific: Non-Target Specific Threat Agents are computer viruses, worms, trojans and logic bombs. Employees: Staff, contractors, operational/maintenance personnel, or security guards who are annoyed with the company. Organized Crime and Criminals: Criminals target information that is of value to them, such as bank accounts, credit cards or intellectual property that can be converted into money. Criminals will often make use of