As a risk assessment professional, when I get into a risk discussion, most security people want to talk about THREAT! Threat is the most sexy and exciting part of doing a risk assessment.
Threats are exciting all by themselves. Think about all the threats you can name:
All the natural disasters like Earthquakes, Tornadoes, Storms, Hurricanes, Tsunamis, Lightning, Floods
Crimes like Homicide, Assault, Rape, Burglary, Theft, Kidnapping, Blackmail, Extortion
Terrorism like Sabotage, Explosions, Mail Bombs, Suicide Bombs
All the IT Threats like Malicous Code, Disclosure, Data Breaches, Theft of Data
And about 50 more including Chem/Bio incidents, Magnetic waves, High Energy Bursts, Microbursts, Contamination and Reputation Damage.
Each of these threats could theoretically occur at any time, but we try to establish a pattern of how often they have occurred in the past, in this location, in this county, in this country, in the company, etc. So NASA, for example, gets thousands of hacker attacks, but another company, like the local Salvation Army, gets 1 every 10 years.
Same model for natural disasters, although you might have to factor in climate change, it’s easy to get the threat incidents for hurricanes in Florida, snow storms in Cleveland, earthquakes in northern California, etc.
We also like to examine industry specific data to see if some threats are higher in a certain industry, like the high incidence of workplace violence incidents in hospitals and high risk retail establishments (like Wawa or 7-11).
Another factor we use in calculating threat likelihood is how the threat could actually affect different types of assets…. for example, would an earthquake damage a car? Probably not. Would it cause damage to an old historical building – probably (unless it had been retrofitted). Could it cause loss of life, or injuries (think Haiti).
So I use a multidimensional model that takes the threats list (I have a standard list of 75 threats that I use), and map it to each potential loss, based on the ‘asset’ that might be affected.
The more data you get, the better your model will be, and the more value it will have as a decision support tool!