This document introduces a security threat mapping template for tracking threats on a continuous basis. The template is meant to track technical weaknesses, exploited vulnerabilities, and organizational threats. It also tracks the impact areas of confidentiality, integrity, availability, and non-repudiation. The template can be used to highlight existing and planned controls and display residual risk after controls are implemented.

1. Parthasarathy, ACA, CISA & CGEIThttp://ae.linkedin.com/in/prpsarathySecurity Threat MappingTemplate is suggestive. It is the personal and professional opinion of the author and it does not represent the view of the organization. Same has been developed over a period of time in interaction with various Organization and security professionals.

2. Objective of Security Threat MappingTrack the threats on a continuous basisTechnical Weakness – When a vulnerability is identified for any product or system or processWeakness Exploited – When a vulnerability is exploited by intruder either in that part of the world or else whereOrganization threats – Attacks that are being experienced by the organizationObsolete – Technological the threat has been eradicated.

3. Security Threat MappingC- Confidentiality, I – Integrity, A- Availability & N – Non repudiation.

4. HOW TO USE ?Track the weakness and trends happening in the region and all over the world.Place the incidence in the respective domain. Highlight the impact area in five colors representing from a score of one to five.Color the segment which are applicable Confidentiality, Integrity, Availability or Non repudiation.

5. Controls for Threat HighlightedHave a specific slide where the controls applicable for the threat with status – change in risk and corresponding risk score due to the implementation of controls.Controls ApplicableExisting ControlNo ControlControls that are planned.

6. Security Threat Mapping after controls implementationDisplay the residual Risk after the application of the controls for existing & planned.

7. Please reach prpsarathy@gmail.com for any suggestions / ClarificationThank youTemplate is suggestive. It is the personal and professional opinion of the author and it does not represent the view of the organization. Same has been developed over a period of time in interaction with various Organization and security professionals.