• Vulnerability
• Threat
• Impact

Risk

Vulnerability * Likelihood * Impact = Risk

• Risk is dynamic
• Agree on your definitions
• It's OK to disagree - explain your decisions
• Be context specific
• Not an exact science

Threat Actors

• Insider - People inside. Most likely group
• Advanced Persistent Threat - Nation states. Political or "geo-financial". Bespoke, subtle, long period of info gathering
• Organised Crime - Clear financial motivation, sophistication varies
• Lone Gunman - Varies
• Automated Attack - Noisy, loud, unsophisticated

Security should be built into the development team