syssec_red_book

A. Methodologiessummarized documents, whereas the majority of reports were collected during2012. The reports come from malware protection vendors, CERTS, securityagencies, commercial companies in the area of security, industrial associationsand committees, and networks of excellence.The collected threat reports were prioritized into a list of current threats,which is included in the ENISA report as an annex (i.e., an actual list of phrasesexcerpted from the original sources). Trends were identified by identifyingthe emerging technologies and projecting the current threat to the respectivetechnological areas.A.2.1RecommendationsENISA recommends that future threat landscape reports and security-managementactors follow some guidelines:• Use a common terminology to refer to attacks, threats, actors, and soforth.• Collect and develop better evidence concerning attack vectors and theimpact achieved by adversaries. This is a challenging objective, but willensure a more rigorous estimation of threat importance and trends.• Collect information about threat agents and, more importantly, correlationsamong them.• Include the user perspective, which is still absent from the majority ofthreat reports (i.e., users are not often the target of such reports).• Develop use cases for threat landscapes, which will help in the analysisof the feasibility of future threats based on current and past landscapes.• Collect security intelligence and share it across organizations as commonknowledge bases.158