Guiding Questions

Outputs

References and resources for Risk & Threat Analysis

Risk Modeling:

• Overview: "Your security plan: An Introduction to Threat Modeling" (Surveillance Self-Defense)

• Guide: "Risk Assessment" (Workbook on Security: Practical Steps for Human Rights Defenders at Risk - Chapter 2)

• Guide: "Threat Assessment: Chapter 2.5 p. 38" (Operational Security Management in Violent Environments (Revised Edition))

• Guide: "Defining The Threshold Of Acceptable Risk" (Integrated Security)

• Guide: "Guide for Conducting Risk Assessments" (NIST 800-30)

• Report: "Risk Thresholds in Humanitarian Assistance" (European Interagency Security Forum)

Threat Modeling Resources (General):

• Book: "Threat Modeling: Designing for Security" (Adam Shostack)
• Website: "Your security plan: An Introduction to Threat Modeling" (Surveillance Self-Defense)
• Article: "Security for Journalists, Part Two: Threat Modeling" (Jonathan Stray)
• Guide: "Managing Information Security Risk: Organization, Mission, and Information System View" (NIST)
• Guide: "Guide for Conducting Risk Assessments" (NIST)
• Activity: "Threat Model Activity" (Tow Center)
• Tool: Deciduous Threat Decision Tree Generator Guide | Tool including sample Tree (Kelly Shortridge)

Risk Assessment Activities:

• Guide: "Risk Assessment" (Operational Security Management in Violent Environments (Revised Edition) - Chapter 2)

• Guide: Risk Assessment (Workbook on Security: Practical Steps for Human Rights Defenders at Risk - Chapter 2)

• Book: "Pre-Mortum Strategy" (Sources of Power: How People Make Decisions - p.71)

Threat Assessment Activities:

• Guide: "Threat Assessment: Chapter 2.5 p. 38" (Operational Security Management in Violent Environments (Revised Edition))

Example text for introducing threats - Integrated Security

Written exercise: Threats assessment - Integrated Security

Facilitators Manual (With PDF download of "Threat Introduction Example Text" and "Threat Assessment Written Exercises") - Integrated Security

Analyzing Threats: Chapter 3 - Workbook on Security: Practical Steps for Human Rights Defenders at Risk

• manual: Establishing the threat level of direct attacks (targeting) (Protection Manual for Human Rights Defenders)

Risk Matrix Activities:

• Guide: "Defining The Threshold Of Acceptable Risk" (Integrated Security)

• Guide: "Risk Analysis: Chapter 2.7 - Operational Security Management in Violent Environments (Revised Edition)" (HPN - Humanitarian Practice Network)

Risk Assessment: Chapter 2 - Workbook on Security: Practical Steps for Human Rights Defenders at Risk

Alternative Risk Modeling Activities:

• Workbook on Security: Practical Steps for Human Rights Defenders at Risk

• Guide: "Risk Assessment For Personal Security" (CPNI - Centre for the Protection of National Infrastructure)s

• Guide: "Threat Assessment & the Security Circle" (Frontline Defenders)

• Case Study: "Case Study 1 Creating a Security Policy" (Frontline Defenders)

Threat research by focus area:

• Human Rights
  • Freedom House's "Freedom in the World" index is the standard-setting comparative assessment of global political rights and civil liberties.
  • Amnesty International regional news on human rights
  • Human Rights Watch - Browse by Region
• Transparency [^corruptions_perception_index]
  • Corruption Perception Index
• Public Service Delivery
• Health
• Free Media and Information
  • Threatened Voices: Tracking suppression of online free speech.
  • IREX’s Media Sustainability Index (MSI) provides in-depth analyses of the conditions for independent media in 80 countries across the world.
  • Freedom House's "Freedom on the Net" index, assessing the degree of internet and digital media freedom around the world.
  • Freedom House's "Freedom of the Press" index assess' global media freedom.
  • ARTICLE 19 freedom of expression and freedom of information news by region.
  • Open Society Foundation - Mapping digital media
  • Press Freedom Index (RSF)
• Climate Issues
• Gender Issues
• Poverty Alleviation
• Community Building
• Peace promotion
• Agricultural Development
• Entrepreneurship
• Water, Sanitation
• Transportation
• Disaster Relief

Threat research by method:

• Country threat reports [^EISF_Alerts]
• Examine Transparency Reports
  • Find most used sites in region. [^alexa]
  • Search for transparency reports for most used sites. [^transparency]

General Threats by Region:

• Database: "The Aid Worker Security Database (AWSD) records major incidents of violence against aid workers, with incident reports from 1997 through the present." (The Aid Worker Security Database (AWSD))

• Platform: "The HumanitarianResponse.info platform is provided to the humanitairan community as a means to aid in coordination of operational information and related activities." (Humanitarian Response)

• Organization: "ReliefWeb has been the leading source for reliable and timely humanitarian information on global crises and disasters since 1996." (ReliefWeb)

Legal Threats by Region

• Monitor: "CNL's NGO Law Monitor provides up-to-date information on legal issues affecting not-for-profit, non-governmental organizations (NGOs) around the world." (NGO Law Monitor)

• Survey: ["This is a survey of existing and proposed laws and regulations on cryptography - systems used for protecting information against unauthorized access."(http://www.cryptolaw.org/)] (The Crypto Law Survey)

• Resource: "Transparency Reporting Index: collects information on companies which publish transparency reports and highlights best and worst practices." (Access Now)

• Website: "This website contains information on regulations, policies, and local organizations working on issues related to digital rights in Latin America. The information is organized by country" (RedLatAm)

• Article: "Legal Issues in Penetration Testing" (Security Current)

• Wiki Page: ["Anti-circumvention: Laws and Treaties"(https://en.wikipedia.org/wiki/Anti-circumvention)] (Wikipedia)

• Guide: "Encryption and International Travel" (Princeton University)

• Guide: "World Map of Encryption Laws and Policies" (Global Partners Digital)

• List: "National Cyber Security Policy and Legal Documents" (NATO Cooperative Cyber Defence Centre of Excellence)

Technical Threats

• Database: "APT Groups and Operations"

• Database: "APTNotes"

• Country Profiles: "Current cybersecurity landscape based on the five pillars of the Global Cybersecurity Agenda namely Legal Measures, Technical Measures, Organisation Measures, Capacity Building and Cooperation." ( Global Cybersecurity Index (GCI))

• Reports: Search Privacy International's in-depth country reports and submissions to the United Nations. (Privacy International)

• Organization: "The Citizen Lab is an interdisciplinary laboratory based at the Munk School of Global Affairs, University of Toronto, Canada focusing on advanced research and development at the intersection of Information and Communication Technologies (ICTs), human rights, and global security." (The Citizen Lab)

• Database: "International Cyber Developments Review (INCYDER)" (NATO Cooperative Cyber Defence Centre of Excellence)

• Guide: "This handbook sets out an overview of the key privacy and data protection laws and regulations across 72 different jurisdictions, and offers a primer to businesses as they consider this complex area of compliance." (Data Protection Laws of the World - DLA PIPER)

• Reports: "Country Reports" (Open Network Inititiative)

• Reports: "Regional Overviews" (Open Network Inititiative)

Targeted Malware

• Reports: "APWG Phishing Attack Trends Reports" (Anti-Phishing Working Group)

Censorship and Surveillance Reports

• Map: "Cyber-Censorship Map" (Alkasir)

• Dashboard: "At-A-Glance Web-Blockage Dashboard" (Herdict )

Travel Threats

• List: "Foreign travel advice" (GOV.UK)

• List: "Travel Advice" (Australian Government)

• Alerts: "Travel Alerts & Warnings" (US Department of State)

• List: "List of airlines banned within the EU" (European Commission)

• List: "A list of aircraft operators that have that have suffered an accident, serious incident or hijacking." (Aviation Safety Network)

• Map: "A global display of Terrorism and Other Suspicious Events" (Global Incident Map)