Those attacks and risks that (always) remain define our “design-basis threat.” This is a term from physical security that describes the most capable threat a defensive posture is designed to defeat with a high degree of confidence.

For example, a nuclear reactor’s containment dome might be required / designed to withstand two successive direct impacts by large passenger jets fully loaded with fuel, without a radiological release. But not three such impacts. We can use the same concept for our cyber defenses – what are the most capable, most consequential attacks that we defeat without suffering unacceptable losses?

Having defined our current design basis threat in terms of attacks we do and do not defeat, we must then ask, do any of these left-over attacks that we do not defeat constitute credible threats? What does that mean?

Well, imagine a small rural water utility. Thirty employees, most of whom spend most of their days with trucks and backhoes digging holes in the ground. Is it possible for a nation-state – say the Russians – to plant a sleeper cell of three cybersecurity gurus in the workforce of the small water utility? And activate the cell four years from now to trigger a catastrophic insider cyber attack on the water utility?

Well yes, it’s possible. The exercise might cost as much as five or six million dollars to pull off, and yes, Russian intelligence agencies or their army do have that much money. Is such an attack reasonable though? Why would the Russians or anyone else bother with such a sophisticated, costly attack on such an inconsequential utility in the middle of nowhere? The threat does not seem credible – it does not seem reasonable to believe that such an attack will ever occur.

What about the same hypothetical attack on the city of Washington, D.C.? Well, that’s another matter. Such an attack on the American capital might well be considered a credible / believable threat.

So, having determined our current design-basis threat level, we can then ask “are any of the attacks ‘above’ the DBT line (i.e. not defeated with a high degree of confidence)? Are any of those attacks credible threats?”