Threat classes

A threat class names a kind of event that can go wrong: phishing, ransomware, fire, a departing insider. It is one of the two catalogs that classify a risk. The other is the vulnerability class.

A threat class does more than label a risk:

• The gap analysis crosses your threat classes with your asset classes. It shows the risks you have not written yet.
• An incident uses the same catalog. An incident and the risk that predicted it share a threat class.

Build the catalog

1. Open Risks → Threat Classes and select Add threat class.
2. Give it a name and a description of what the event looks like. devguard creates the slug from the name.
3. In the risk form, choose one threat class under Impact for each risk.

The template picker also builds the catalog. When you create risks from templates, it links the threat class that each template names. If you have no class of that name, it creates one. It matches on the slug, so "Ransomware" is reused, not doubled.

Keep the catalog coarse. One class per attack technique makes the gap analysis hard to read. One class per kind of event keeps it useful: unauthorized access, malware, loss of a device, power outage.

Reference

Fields

Where a class is used

The class's detail page lists the risks classified under it, with Comments and History tabs. The register filters by threat class, and the gap analysis shows the class as a column.

• Archiving a class hides it from pickers and from the gap analysis.
• Deleting a class removes it from the risks and incidents that used it. It also removes its expected pairs in the gap analysis.

Import and export

The list's menu offers Import CSV, Download CSV template, and the exports. The template's columns are slug, name, and description. A blank slug is created from the name. Delimiters, encodings, and refused rows work as for risks.

name;description
Phishing;Staff are tricked into handing over credentials or approving a prompt
Ransomware;Systems and backups are encrypted and payment demanded
Lost or stolen device;A laptop or phone with company data leaves the company's hands

Permissions and API

Owners, admins, and organization tokens create, edit, archive, and delete threat classes. Members and auditors can only read.

A risk names its class with threatClassId on POST /risks/ or PATCH /risks/{id}/.