{"licence":{"name":"CC BY-SA 4.0","spdx":"CC-BY-SA-4.0","url":"https://creativecommons.org/licenses/by-sa/4.0/","attribution":"Atlas, a bilingual technical dictionary (https://cmaintz.github.io/tech-atlas/)"},"id":"security/threat","url":{"en":"https://cmaintz.github.io/tech-atlas/en/terms/security/threat/","da":"https://cmaintz.github.io/tech-atlas/da/terms/security/threat/"},"term":{"en":"Threat","da":"Trussel"},"aka":{"en":[],"da":[]},"domain":["security"],"cluster":"fundamentals","layer":"governance","status":"current","summary":{"en":"Anything that could harm the organisation - an attacker, a careless mistake, a fire or a power cut.","da":"Alt, der kan skade organisationen - en angriber, en skødesløs fejl, en brand eller et strømsvigt."},"body":{"formal":{"en":"Any person, event or circumstance with the potential to cause harm to information or systems by damaging their confidentiality, integrity or availability. A threat does harm only when it meets a weakness it can use.","da":"Enhver person, hændelse eller ethvert forhold, der kan forvolde skade på information eller systemer ved at ramme deres fortrolighed, integritet eller tilgængelighed. En trussel gør først skade, når den møder en svaghed, den kan udnytte."},"plain":{"en":"Like a burglar in the neighbourhood or a storm in the forecast - it has not hurt you yet, but it could.","da":"Som en indbrudstyv i kvarteret eller en storm i vejrudsigten - den har ikke ramt dig endnu, men den kunne."},"inPractice":{"en":"A Danish shipping company lists its threats - criminal groups sending phishing mails, staff mistakes, a supplier's remote access and flooding of the basement server room.","da":"Et rederi opstiller sine trusler - kriminelle grupper, der sender phishingmails, fejl begået af medarbejdere, en leverandørs fjernadgang og oversvømmelse af serverrummet i kælderen."},"whyItMatters":{"en":"You cannot guard against what you have not named; knowing the threats tells you what to prepare for and what to ignore.","da":"Man kan ikke beskytte sig mod det, man ikke har sat navn på; kender man truslerne, ved man, hvad man skal forberede sig på, og hvad man kan se bort fra."}},"deepDive":{"en":"In formal risk methodology a threat is decomposed into a threat source and a threat event. NIST SP 800-30 Rev. 1 classifies sources into four types: adversarial (individuals, groups, organisations or states acting with intent), accidental (erroneous action by a user or administrator), structural (failure of equipment, software or environmental controls, such as a disk or an aircon unit), and environmental (natural or human-made disasters - fire, flood, power loss). This taxonomy matters because it keeps risk assessment honest: an organisation that models only hackers systematically underweights the accidental deletion, the failed backup and the flooded basement that cause a large share of real losses. A threat becomes consequential only in combination with a vulnerability it can act on and an asset of value; a threat with no corresponding weakness produces no risk.\n\nFor adversarial threats specifically, the discipline of threat modelling makes the analysis systematic. STRIDE enumerates categories of what can go wrong (spoofing, tampering, repudiation, information disclosure, denial of service, elevation of privilege); attack trees decompose a goal into steps; and the MITRE ATT&CK knowledge base catalogues the real-world tactics and techniques adversaries use, giving defenders a shared vocabulary for describing behaviour. NIST SP 800-30 assesses adversarial threat events along dimensions of capability, intent and targeting, so that a capable but uninterested actor and an eager but unskilled one are scored differently rather than lumped as \"hackers\".\n\nThreat intelligence operationalises this at national and organisational level. In Denmark the Danish Resilience Agency (Styrelsen for Samfundssikkerhed, SAMSIK), which absorbed the Centre for Cyber Security (CFCS) in 2025, publishes recurring threat assessments (the national cyber threat picture), rating the threat from, for example, cyber crime and cyber espionage on a qualitative scale; these feed the threat identification step of a risk assessment. Distinguishing a threat from adjacent terms is essential to using any of this correctly: a threat is a potential cause of harm, a vulnerability is the weakness it would exploit, a threat actor is the specific adversary behind an adversarial threat, and risk is the combination of a threat's likelihood with its impact.\n\nA recurring misconception is to conflate threat with risk and act on the scariest-sounding threat rather than the most probable and impactful one; the point of naming threats is to feed a structured assessment, not to drive spending by fear. Another is treating the threat catalogue as static - the threat landscape shifts as new actors, tools and dependencies appear, so threat identification is a repeated activity, not a one-off list. Finally, focusing only on external adversaries ignores the insider, the third-party supplier and the non-malicious failure, all of which the four-type taxonomy is designed to keep in scope.","da":"I formel risikometodik dekomponeres en trussel i en trusselskilde og en trusselshændelse. NIST SP 800-30 Rev. 1 inddeler kilder i fire typer: aktørbaserede (personer, grupper, organisationer eller stater, der handler med hensigt), utilsigtede (fejlhandling begået af en bruger eller administrator), strukturelle (svigt i udstyr, software eller miljøkontroller, fx en disk eller et køleanlæg) og miljømæssige (natur- eller menneskeskabte katastrofer - brand, oversvømmelse, strømsvigt). Denne taksonomi er vigtig, fordi den holder risikovurderingen ærlig: en organisation, der kun modellerer hackere, undervurderer systematisk den utilsigtede sletning, den fejlede backup og den oversvømmede kælder, som står for en stor del af de reelle tab. En trussel bliver først konsekvensfyldt i kombination med en sårbarhed, den kan handle på, og et aktiv af værdi; en trussel uden en tilsvarende svaghed giver ingen risiko.\n\nSærligt for aktørbaserede trusler gør disciplinen trusselsmodellering analysen systematisk. STRIDE opregner kategorier af, hvad der kan gå galt (spoofing, tampering, repudiation, information disclosure, denial of service, elevation of privilege); attack trees dekomponerer et mål i trin; og MITRE ATT&CK-vidensbasen katalogiserer de taktikker og teknikker, modstandere faktisk bruger, og giver forsvarere et fælles sprog til at beskrive adfærd. NIST SP 800-30 vurderer aktørbaserede trusselshændelser ud fra evne, hensigt og målretning, så en kapabel, men uinteresseret aktør og en ivrig, men ukyndig aktør scores forskelligt frem for at blive slået sammen som \"hackere\".\n\nTrusselsefterretning operationaliserer dette på nationalt og organisatorisk niveau. I Danmark udgiver Styrelsen for Samfundssikkerhed (SAMSIK), som Center for Cybersikkerhed (CFCS) blev en del af i 2025, tilbagevendende trusselsvurderinger (det nationale cybertrusselsbillede) og vurderer truslen fra fx cyberkriminalitet og cyberspionage på en kvalitativ skala; de indgår i trusselsidentifikationstrinnet af en risikovurdering. At skelne en trussel fra nabobegreberne er afgørende for at bruge noget af dette korrekt: en trussel er en mulig årsag til skade, en sårbarhed er den svaghed, den ville udnytte, en trusselsaktør er den konkrete modstander bag en aktørbaseret trussel, og risiko er kombinationen af en trussels sandsynlighed og dens konsekvens.\n\nEn tilbagevendende misforståelse er at sammenblande trussel med risiko og handle på den mest skræmmende trussel frem for den mest sandsynlige og konsekvensfyldte; formålet med at navngive trusler er at fodre en struktureret vurdering, ikke at styre forbruget efter frygt. En anden er at behandle trusselskataloget som statisk - trusselsbilledet skifter, efterhånden som nye aktører, værktøjer og afhængigheder dukker op, så trusselsidentifikation er en gentagen aktivitet, ikke en engangsliste. Endelig overser et ensidigt fokus på eksterne modstandere insideren, tredjepartsleverandøren og det ikke-ondsindede svigt, som firetype-taksonomien netop skal holde i spil."},"edges":[{"type":"exploits","to":"security/vulnerability","why":{"en":"A threat only does harm when it finds a weakness to use.","da":"En trussel gør først skade, når den finder en svaghed at udnytte."},"confidence":"high","strength":"primary"}],"depth":0,"sources":[{"title":"Cyber Security Fast Track - Ordliste","tier":"course-material"},{"title":"NIST SP 800-30 Rev. 1 - Guide for Conducting Risk Assessments","tier":"standard","publisher":"NIST"}],"draft":true}