NoAVision is a mid-sized cybersecurity solutions provider based in Tartu, Estonia.

ISO/IEC 27005:2022 classifies threat sources into three types: accidental (unintentional human errors), environmental (natural events, infrastructure failures), and deliberate (intentional, malicious actions by threat agents). The scenario describes the forging of user rights within the IAM system to escalate privileges and gain unauthorized access to restricted data. Forging is an intentional, calculated act performed by a malicious actor — this clearly qualifies as a deliberate threat source. Accidental threats involve unintended mistakes without malicious intent. Environmental threats involve natural disasters or infrastructure issues. Deliberate threats, as defined in ISO/IEC 27005, include unauthorized access, data theft, sabotage, and manipulation — all applicable to privilege escalation attacks on IAM systems.

================