other malware, but a serious study to apply cost effective countermeasures can only be conducted following a rigorous IT risk analysis in the framework of an ISMS: a pure technical approach will let out the psychological attacks that are increasing threats. Threats classification Threats can be classified according to their type and origin: Types of threats: Physical damage: fire, water, pollution Natural events: climatic, seismic, volcanic Loss of essential services: electrical power, air conditioning, telecommunication Compromise of information: eavesdropping, theft of media, retrieval of discarded materials Technical failures: equipment, software, capacity saturation Compromise of functions: error in use, abuse of rights, denial of actions Note that a threat type can have multiple origins. Deliberate: aiming at information asset spying illegal processing of data Accidental equipment failure software failure Environmental natural event loss of power supply Negligence: Known but neglected factors, compromising the network safety and sustainability Threat classification Microsoft published a mnemonic, STRIDE, from the initials of threat groups: Spoofing of user identity Tampering Repudiation Information disclosure (privacy breach or Data leak) Denial of Service (D.o.S.) Elevation of privilege Microsoft previously rated the risk of security threats using five categories in a classification called DREAD: Risk assessment model. The model is considered obsolete by Microsoft. The categories were: Damage – how bad would an attack be? Reproducibility – how easy it is to reproduce the attack? Exploitability – how much work is it to launch the attack? Affected users – how many people will be impacted? Discoverability – how easy it is to discover the threat? The DREAD name comes from the initials of the five categories listed. The spread over a network of threats can lead to dangerous situations. In military and civil fields, threat level has been defined: for example INFOCON is a threat level used by the US. Leading antivirus software vendors publish global threat level on their websites. Associated terms Threat agents or actors The term Threat Agent is used to indicate an individual or group that can manifest a threat. It is fundamental to identify who would want to exploit the assets of a company, and how they might use them against the company. Individuals within a threat population; Practically anyone and anything can, under the right circumstances, be a threat agent – the well-intentioned, but inept, computer operator who trashes a daily batch job by typing the wrong command, the regulator performing an audit,