Protecting the Critical National Infrastructure - Developing a Method for the Measurement of Threat Agents in an Information Environment

摘要

While there are a number of existing methodologies for the calculation of risk to information environments that were reviewed, none of them were suitable for use in determining the level of threat to an information environment. As a result, the method that is described in this paper was created. In the current and future environments, where the information and communications systems have become ubiquitous and essential to the welfare of nation states and corporations, it is no longer" viable to categorise the threats to these systems in simplistic levels of high, medium or low, with no audit trail on the reasoning that led to the assessment. In addition organisations need to be able to define the potency and sustainability of a threat agent and determine whether it is increasing or decreasing. If progress is to be made delivering reasoned arguments for the reason for changes in the environment on which the investment in resources and finances can be justified, then a method which can be understood and on which changes to the environment can be evaluated must be used. The method described above provides a framework on which such a method can be developed.