System and method for cybersecurity operations threat modeling

A method for cybersecurity operations threat modeling, comprising:

• receiving, by a threat assessment computer program, threat data comprising malicious cyber activity;
• identifying, by the threat assessment computer program, a plurality of threat actor groups from the threat data, wherein each threat actor group is associated with malicious cyber activity that is under common control of the threat actor group;
• categorizing, by the threat assessment computer program, each threat actor group into a threat actor group category;
• prioritizing, by the threat assessment computer program, Tactics, Techniques and Procedures (TTPs) for the threat actor groups based on the categorization;
• identifying, by the threat assessment computer program, a threat actor group category of interest;
• collecting, by the threat assessment computer program, operational data from an organizational system;
• generating, by the threat assessment computer program, a threat model by applying the identified TTPs to the operational data;
• and
• deploying, by the threat assessment computer program, at least one countermeasure to the organizational system based on the identified threat actor group category.

An electronic device, comprising:

• a memory storing a threat assessment computer program;
• and
• a computer processor;
• wherein, when executed by the computer processor, the threat assessment computer program causes the computer processor to:
• receive threat data comprising malicious cyber activity;
• identify a plurality of threat actor groups from the threat data, wherein each threat actor group is associated with malicious cyber activity that is under common control of the threat actor group;
• calculate a threat actor sophistication score for each of the plurality of threat actor groups;
• calculate a key motivations and intent score for each of the plurality of threat actor groups;
• calculate a final threat score based on the threat actor sophistication score and the key motivations and intent score for each of the plurality of threat actor groups;
• rank the plurality of threat actor groups based on their final threat scores;
• prioritize Tactics, Techniques and Procedures (TTPs) for the threat actor groups based on the ranking;
• collect operational data from an organizational system;
• generate a threat model by applying the identified TTPs to the operational data;
• and
• deploy at least one countermeasure to the organizational system based on the threat model.