Writing a threat statement

Name:

Date:

Class:

Quick Questions

Shade in the A or B circle for each question.

1. Which parts must a complete threat statement name?

A Only the name of the malware used

B The actor, the vulnerability, the asset and the impact

2. Which sentence is a better threat statement?

A Hackers are bad and could attack things.

B A cybercriminal could guess the weak password on a student's email account, because it is short, and leak private messages.

3. In 'An insider could open the unlocked server room because the door has no lock, and steal customer records', what is the asset?

A Customer records

B The insider

4. In 'A scammer could trick a user into sharing a password because the user cannot spot fake emails', what is the vulnerability?

A The user cannot spot fake emails

B The scammer

5. What is the job of the word 'because' in a threat statement?

A It links the cause (the vulnerability) to the effect (the attack succeeding)

B It lists the assets in alphabetical order

Match the Pairs

Draw a line connecting each item on the left to its match on the right.

Left column		Right column
1An outsider guesses the weak password on a student's email account and reads private messages.		AStudent records could be leaked because the database has default login details.
2because		BA scammer could steal money from the school's bank account because a staff member reuses a weak password.
3A threat statement must name the actor, the vulnerability, the asset and the impact.		CA complete threat statement: it names the actor, the vulnerability, the asset and the impact in one sentence.
4Because links the cause (vulnerability) to the effect (impact) in a threat statement.		DThe linking word that joins the vulnerability to the impact so the statement shows cause and effect.
5Hackers are dangerous and could harm the school.		EThe vulnerability is missing and there is no because. It does not explain why the attack is possible.
6An attacker could lock the school's files and demand payment.		FIt is too vague. It does not name a specific actor, a vulnerability, an asset or a clear impact, and has no because to link cause and effect.

Definitions

threat statement

Fill in the Blanks

Complete each line of code by filling in the missing parts.

A hacker can leak student records _______ the website has a weak login.

_____: a hacker Vulnerability: no multi-factor login Asset: staff email accounts

Actor: a scammer _____________: staff reuse passwords Asset: the school email system

Actor: a ransomware gang Vulnerability: outdated server software _____: patient health records

Actor: a hacker Vulnerability: unpatched web server ______: customers lose their data

Spot the Error

Shade in the letter of the line that contains an error.

Question 1

A Actor: a scammer

B Vulnerability: weak password

C Asset: weak password

D Impact: private emails leaked

Question 2

A An attacker can guess logins

B because the password is weak,

C so student records are safe.

Question 3

A A thief can steal the laptop

B so it was left unlocked,

C so saved files are exposed

Question 4

A Actor: a careless insider

B Vulnerability: files deleted

C Asset: the shared class files

D Impact: work is lost for good

Question 5

A Actor: a weak password

B Vulnerability: weak password

C Asset: online bank account

D Impact: money is stolen

Answer Key

Writing a threat statement

Section A: Quick Questions

B — The actor, the vulnerability, the asset and the impact

B — A cybercriminal could guess the weak password on a student's email account, because it is short, and leak private messages.

A — Customer records

A — The user cannot spot fake emails

A — It links the cause (the vulnerability) to the effect (the attack succeeding)

Section B: Match the Pairs

An outsider guesses the weak password on a student's email account and reads private messages. → A complete threat statement: it names the actor, the vulnerability, the asset and the impact in one sentence.

because → The linking word that joins the vulnerability to the impact so the statement shows cause and effect.

A threat statement must name the actor, the vulnerability, the asset and the impact. → A scammer could steal money from the school's bank account because a staff member reuses a weak password.

Because links the cause (vulnerability) to the effect (impact) in a threat statement. → Student records could be leaked because the database has default login details.

Hackers are dangerous and could harm the school. → It is too vague. It does not name a specific actor, a vulnerability, an asset or a clear impact, and has no because to link cause and effect.

An attacker could lock the school's files and demand payment. → The vulnerability is missing and there is no because. It does not explain why the attack is possible.

Section C: Definitions

threat statement — One sentence naming the actor, the vulnerability they use, the asset at risk and the impact, using because to link cause and effect.

Section D: Fill in the Blanks

A hacker can leak student records
because the website has a weak login.

Actor: a hacker
Vulnerability: no multi-factor login
Asset: staff email accounts

Actor: a scammer
Vulnerability: staff reuse passwords
Asset: the school email system

Actor: a ransomware gang
Vulnerability: outdated server software
Asset: patient health records

Actor: a hacker
Vulnerability: unpatched web server
Impact: customers lose their data

Section E: Spot the Error

C — A weak password is the vulnerability, not the asset. The asset is the thing of value at risk, such as the student email account.

C — The last part of a threat statement must state the harmful impact. Records that are safe mean no harm happened. It should say the records are leaked.

B — The cause (the vulnerability) must come after 'because'. 'so' introduces an effect, so it should read 'because it was left unlocked,'.

B — 'Files deleted' is an impact, not a weakness. The vulnerability is the gap the actor uses, such as having no backups.

A — The actor is the person or group who carries out the threat. A weak password is a vulnerability. The line should name an actor such as a cyber criminal.