What are the two types of 'terrorists' to consider in vulnerability assessments?

What are the two types of 'terrorists' to consider in vulnerability assessments?

• A. Insiders and Stealth Outsiders
• B. Customers and Regulators
• C. Hackers and Environmentalists
• D. Competitors and Insiders

Answer: (A)

In vulnerability assessments for security, the two main threat actors to consider are insiders and stealth outsiders. Insiders are people who already have legitimate access to the facility or systems—employees, contractors, or others who could misuse that access. Stealth outsiders are external individuals who try to enter or operate without being detected, aiming to blend in and avoid notice while causing harm. Focusing on these two groups lets you tailor protections: controls for insiders address access, monitoring, and reducing opportunities for misuse; controls for stealth outsiders bolster physical security, visitor screening, surveillance, and detection. Other groupings don’t fit the typical threat model as clearly, since customers, regulators, or activists aren’t the standard malicious threat categories in this context, and a general “outsiders” label doesn’t emphasize the crucial difference between those who already have legitimate access and those who must bypass defenses.

In vulnerability assessments for security, the two main threat actors to consider are insiders and stealth outsiders. Insiders are people who already have legitimate access to the facility or systems—employees, contractors, or others who could misuse that access. Stealth outsiders are external individuals who try to enter or operate without being detected, aiming to blend in and avoid notice while causing harm. Focusing on these two groups lets you tailor protections: controls for insiders address access, monitoring, and reducing opportunities for misuse; controls for stealth outsiders bolster physical security, visitor screening, surveillance, and detection. Other groupings don’t fit the typical threat model as clearly, since customers, regulators, or activists aren’t the standard malicious threat categories in this context, and a general “outsiders” label doesn’t emphasize the crucial difference between those who already have legitimate access and those who must bypass defenses.