Re: List of Information Security Threats

[Shailesh Rangari <shailesh.sf () gmail com>]

I second that opinion. Thats the way 'Risk Assessment' is done. It is  
better to Identify all the Assets that need to be Secured and then  
brainstorm over the potential Threats one would be Vulnerable to.
Though its not a bad idea to enumerate some generic threats, but then  
you should refrain yourself from matching these generic threats to  
your assets compulsively.

Shailesh

On Mar 10, 2009, at 11:25 AM, jwmeritt () aol com wrote:

> In my opinion, the way to go would not be to enumerate generic  
> "threats" (which they may ignore anyway) but to acquire an  
> exhaustive list of their information assets (phone numbers,  
> proprietary documents, shipping... ) and then go through THAT list  
> and write the identified threats against THAT.  They will be much  
> less likely to ignore something if it explicitely is a threat TO THEM.