Threat Catalogue

A threat is something that could act against your information — an attacker, a mistake, a fire, a hardware failure. A risk record pairs one threat with one vulnerability: the thing that could act, and the weakness it would act through.

Fields

• Code
  Unique identifier, issued from the catalogue's number template when left empty.

• Name
  The threat itself.

• Threat source
  Where it comes from. One of four fixed values — see below.

• Description
  What the threat covers, and what it does not.

• Active
  Inactive threats are no longer offered on a risk form. Existing risks keep the threat they named.

The four threat sources

The source is a fixed set, not a list you curate:

Source	Means
Human — deliberate	A person acting on purpose: an attacker, an insider, a competitor.
Human — accidental	A person acting by mistake: a misconfiguration, a message to the wrong recipient.
Environmental	Fire, flood, earthquake, power loss.
Technical	Hardware failure, software fault, capacity exhaustion.

note

These four are fixed because they are what ISO 27005 classifies by, and because the catalogue has to stay comparable across installations. A reporting taxonomy that each customer extended would stop being a taxonomy.

The distinction between the two human sources is the one that carries the most weight in practice. Deliberate and accidental threats have entirely different probability profiles and entirely different controls — awareness training addresses one and access control the other.

The shipped catalogue

The module ships with 40 threats covering the four sources. It is a starting point, not a fixed list: you may rename, deactivate, delete or add to it freely.

The rows ship in English. They are default content, and the catalogue is meant to be curated rather than accepted as it stands.

note

The catalogue is seeded on first install only. A later upgrade will not re-add a row you deliberately removed, and will not overwrite one you rewrote — the seed does not argue with a decision you made about your own catalogue.

Keeping the catalogue usable

The risk form's threat picker shows the catalogue flat. Nothing narrows it by source, by asset type or by the vulnerability you have chosen — so search and filtering carry the weight, and the catalogue's length is what decides whether people find the right row or invent a new one.

tip

Forty rows is about the right size. Resist growing it past a hundred: a catalogue too long to scan gets used as a search box, and a threat that is hard to find gets recorded as a near-duplicate of one that already exists. Merge rather than add when a new threat is a variation of an existing one.

Deleting a threat

A threat cannot be deleted while any open risk names it. The refusal is explicit rather than a database error, and it names the situation.

Bulk delete refuses the whole selection when any one row is in use. It does not delete what it can and skip the rest — a partial delete leaves nobody able to say what actually happened.

tip

Deactivate rather than delete. A deactivated threat disappears from the picker while the risks that named it stay readable, which is what you want for anything that has ever been assessed.

Excel import and export

The catalogue exports to Excel and re-loads from a filled-in template. Leaving the code column blank has the code issued from the catalogue's own number template.

This is the practical way to load your own threat list: export the shipped catalogue, edit it in the spreadsheet, and load it back.