Threat Analysis and Mitigation Strategies

Threat analysis is the process of examining specific threats in sufficient depth to understand how they operate, what they target, who is likely to conduct them, and what conditions make an organisation susceptible. The goal is not simply to produce a list of threats but to develop an understanding that supports well-targeted, proportionate and effective mitigation.

Mitigation strategies are the actions an organisation takes to reduce the likelihood or impact of a specific threat. Effective mitigation is always threat-informed: it addresses the specific characteristics of the threats facing the organisation rather than applying generic controls without considering whether they address the actual risks.

Understanding Threat Actors

Different threats come from different sources, and understanding the likely source of a threat helps organisations prioritise their defences appropriately. The main categories of threat actor are:

• Cybercriminals: financially motivated individuals or organised groups who conduct attacks for monetary gain through ransomware, fraud, data theft and extortion. Cybercriminals are responsible for the majority of breaches globally and are the most common threat facing most commercial organisations.
• Nation-state actors: government-sponsored groups that conduct cyber espionage, intellectual property theft and infrastructure disruption for political, military or economic objectives. Nation-state actors tend to be highly sophisticated and patient, conducting long-term campaigns against high-value targets including critical infrastructure, defence contractors, research institutions and government agencies.

The WEF Global Cybersecurity Outlook 2025 found that geopolitical tensions are influencing cyber strategy in nearly 60 per cent of organisations.

• Hacktivists: individuals or groups motivated by political, ideological or social goals who conduct attacks to disrupt, embarrass or draw attention to organisations they oppose. Hacktivist attacks tend to focus on website defacement, distributed denial-of-service (DDoS) attacks and data leakage.
• Insider threats: as discussed in Step 2, insider threats may be deliberate (a disgruntled employee, a fraudster or a corporate spy) or accidental (a well-intentioned employee who makes an error with significant consequences). Both categories require mitigation strategies, but they require different approaches: deliberate insider threats require access controls, monitoring and background verification, while accidental insider threats require training, clear processes and a reporting culture.
• Script kiddies and opportunistic attackers: low-sophistication attackers who use publicly available tools and techniques to exploit easily discovered vulnerabilities. While they lack the sophistication of organised criminal groups or nation-state actors, they target organisations indiscriminately and in high volume, meaning even well-defended organisations are regularly probed.

Mitigation Strategies: A Layered Approach

Effective mitigation of cyber threats is never a single action. It requires a layered approach in which multiple controls work together to reduce both the likelihood of an incident and the impact if one occurs. This is the principle of defence in depth introduced in Week 2, and it applies directly to the threat categories identified this week.

Mitigating Phishing and Social Engineering

• Technical controls: email filtering systems that detect and quarantine suspicious messages; web filtering that blocks access to known malicious websites; multi-factor authentication that limits the damage from credential theft; and anti-spoofing technologies such as DMARC, DKIM and SPF that reduce the effectiveness of email impersonation attacks.
• People controls: regular, realistic security awareness training that helps staff recognise phishing attempts; clear procedures for verifying unusual requests, particularly those involving financial transactions or data access; a reporting culture in which suspicious emails can be flagged without fear of consequences.
• Process controls: mandatory two-person authorisation for significant financial transactions; verification procedures that require a phone call to a known number (not a number in the suspicious email) before actioning unusual requests; and clear escalation routes for staff who are unsure whether a request is legitimate.

Mitigating Ransomware

• Technical controls: robust backup systems with offline or immutable copies that cannot be encrypted by an attacker; network segmentation that limits the spread of ransomware from an initial infection point; endpoint detection and response tools that identify and block ransomware behaviour; and timely patching to close the vulnerabilities most commonly exploited as ransomware entry points.
• People controls: training on phishing recognition, since phishing is a common ransomware delivery mechanism; clear procedures for reporting a suspected infection immediately, before it spreads.
• Process controls: a tested incident response plan that includes specific procedures for ransomware scenarios; a business continuity plan that defines how operations will continue if key systems are unavailable; and pre-agreed relationships with external incident response specialists who can be engaged quickly in the event of a significant attack.

Mitigating Vulnerability Exploitation

• Technical controls: a robust and timely patch management process that prioritises patches for critical vulnerabilities in internet-facing systems; vulnerability scanning to identify unpatched systems and misconfigurations; network monitoring to detect exploitation attempts; and penetration testing to identify exploitable weaknesses before attackers do.
• Process controls: a change management process that includes security review of new systems and configurations before they are deployed; an asset inventory that ensures all systems are known and included in the patch management process; and a process for tracking and remediating identified vulnerabilities with defined timescales.

Mitigating Third-Party and Supply Chain Risk

• Process controls: security assessments of new suppliers before they are onboarded; contractual requirements for suppliers to maintain appropriate security standards and to notify the organisation promptly in the event of a breach; regular review of supplier access rights; and a process for removing supplier access when a contract ends.
• People controls: ensuring that those who manage supplier relationships understand their security responsibilities and know how to raise concerns if a supplier’s security practices appear inadequate.

The Manager’s Role in Mitigation

As a manager, your direct role in technical mitigation is limited. Your role in people, process and organisational mitigation is central. You influence the likelihood that your team follows security procedures consistently. You create the conditions in which concerns are raised and incidents are reported. You ensure that your team understands its security responsibilities and has the knowledge and processes to meet them. You maintain oversight of who has access to what and whether that access is appropriate. These are not peripheral activities: they are core components of effective threat mitigation.