The “business paradigm” embraces the disciplines of analysis as they apply to process improvement and risk mitigation when they are communicated in familiar terminology, eg. financial ROI, value statements, cost of ownership, etc. Unfortunately, the advanced threat vectors on the cyber battlefield require a different analysis approach that is unfamiliar to business stakeholders – threat analysis.

I agree with Tim – network data must recorded from day one. The “rhythm” of the networks can be discerned from this information. By cross refencing this information with knowledged gleaned from business analyst, one can discover key risk indicators. This forms the foundation to a threat analysis that examines the possible abuse cases in relation to the business.