-The purpose of information system security is to develop security controls to prevent security weaknesses from being exploited by threat agents.
-A threat agent is an entity who is responsible for or who materially contributes to the loss or theft of data. Threat agents may be internal or external to an organization.
-Unintentional agents—Unintentional threat agents are employees, contractors, or other insiders who have no motivation to jeopardize information, but who are untrained or negligent in their handling of sensitive information. An example of an unintentional internal threat agent would be someone in the mailroom who accidentally mailed employee pay information to the wrong addresses.
-Malicious agents—Malicious internal threat agents are current or former employees, contractors, or other insiders who are motivated to compromise security because of unhappiness with company policies, organizational processes, financial difficulties, or personnel actions. In many cases, the malicious internal threat agent is disgruntled, already fired, or soon to be fired from his or her position. An example of a malicious internal threat agent would be an employee who decided to sabotage systems or data just before a round of layoffs.
-Criminal enterprises—Criminal enterprises are groups of skilled technicians who can identify and exploit weaknesses in the systems that store, process, or transmit valuable financial information.
-State-sponsored agents—State-sponsored external threat agents are entities who are directly or indirectly supported by nation-states. They are often well-supported and highly skilled. State-sponsored groups may be motivated by strategic or tactical political objectives as well as by the desire to obtain intellectual property information beneficial to their sponsoring state.
-Terrorists—Terrorists are expanding their ability to attack targets