1.2Threats and Vulnerabilities (Human, Technical, and Physical Threats; Insider Misuse and Negligence)

When designing security controls, misclassifying "what you are protecting against" leads to controls that miss the mark. A threat is a potential cause of harm to an information asset, broadly divided into human, technical, and physical categories. But a threat alone does not create risk — risk only materializes when it meets a vulnerability, a weakness the threat can exploit. This section organizes the threat categories, then examines the risks SG particularly emphasizes: those originating inside the organization (insider misuse and negligence).

1.2.1Three categories of threats

• A human threat arises from human action. It includes both intentional acts (unauthorized access, theft, insider misuse) and unintentional acts, i.e. negligence (misdirected email, misconfiguration, loss of a device). A technical threat exploits the technical mechanisms of systems or networks—malware infection, unauthorized access, DoS attacks, and the like.
• A physical threat includes environmental factors such as earthquakes, fires, and flooding, and physical acts such as equipment destruction, theft, or unauthorized entry. Access control and locks for a server room are countermeasures against physical threats—note that technical controls like firewalls alone cannot prevent these.
• The relationship between threats and vulnerabilities: a vulnerability is a weakness a threat can exploit (misconfiguration, unpatched software, inadequate training, forgetting to lock a door, etc.). Even if a threat exists, risk does not materialize without a corresponding vulnerability (e.g., even with the threat of an earthquake, damage is limited if the server room is built to withstand it). Conversely, a vulnerability without an applicable threat likewise poses low risk.

1.2.2Managing insider misuse and negligence

• Insider misuse is when an employee or an outsourced worker inside the organization abuses their legitimate access rights to exfiltrate or tamper with information. It is said to occur more readily when the three elements of the fraud triangle—motive, opportunity, and rationalization—align. Separation of duties, which avoids concentrating authority in one person, and monitoring access logs serve as deterrents.
• Negligence is risk arising not from intent but from carelessness (a misdirected email, a lost USB drive, an unintended public setting caused by a misconfiguration). Insider misuse and negligence are distinguished by whether intent was present, but both share the common trait of originating from a person inside the organization—both training/education and a double-check system are effective countermeasures for either.
• From SG's management perspective, organizations must not focus solely on technical threats (external attacks) but also systematically assess and manage the risks originating inside the organization—insider misuse and negligence. IPA surveys consistently show that a substantial share of information leaks stem from mishandling, loss, or theft—negligence and internal factors, not just external attackers.

Consider a manufacturing company's IT department analyzing three incidents from the past year. In the first, an accounting staff member used their legitimately granted access to extract a large amount of personal data from the customer database and copy it to an external storage device shortly before resigning. Since the access rights themselves were properly granted, this is not unauthorized technical access but is classified as insider misuse. Root-cause analysis found all three elements of the fraud triangle present: the employee was dissatisfied over a transfer or evaluation (motive), worked alone with no double-check (opportunity), and rationalized it as "no one is watching anyway" (rationalization). The countermeasures adopted are separation of duties (splitting data extraction and review between different people) and regular access-log monitoring. In the second incident, another staff member accidentally entered recipients in the CC field of a bulk email to customers, leaking everyone's address to the other recipients. This is unintentional negligence, addressed by a pre-send double-check process and a system setting that enforces BCC. The third incident involved a server room's air-conditioning failure causing equipment to shut down from overheating — a physical threat (equipment failure), addressed by redundant cooling and temperature-monitoring alerts. Comparing the three shows that even though all are "information security incidents," the effective countermeasure differs entirely depending on whether the cause is human (intentional or not) or physical. A manager must correctly classify the cause before selecting the appropriate control.

1.2.3Section summary

• Threats fall into three categories: human, technical, physical. Risk materializes when a threat meets a vulnerability
• Insider misuse (intentional) and negligence (unintentional) differ in cause and countermeasure. The fraud triangle = motive, opportunity, rationalization
• Deterrents against insider misuse: separation of duties, access log monitoring, periodic review of access rights