1.5 Explain different threat actor, vectors and intelligence sources Flashcards
Someone who takes action.
Actor
A potential harm.
Threat
The person or entity who is responsible for causing any security violating incidents.
Threat actor
An attacker who is operating on behalf of their country’s government, military, or other powerful leadership.
State actor/ nation-state hacker
Someone who uses their hacking skills for a cause or purpose.
Hacktivist
Threat actors who are less knowledgeable than a professional skilled attacker.
Script kiddies
Someone skilled and knowledgeable in a system.
Hacker
An ethical hacker or skilled IT professional.
Authorized hacker
A criminal or malicious attacker.
Unauthorized hacker
Possibly a reformed criminal or a skilled IT professional operating undercover to perform ethical hacking.
Semi-authorized hacker
A term used to describe the IT components deployed by a department without the knowledge or permission of senior management or the IT group.
Shadow IT
Threat and attack vectors
Direct access, wireless, networking, email, supply chain, social media, people, removable media, mobile devices, IoT, embedded devices, remote access, and cloud.
The collection of information about threat actors and the threats they represent.
Threat intelligence sources
The gathering of information from any publicly available resource.
Open-source intelligence (OSINT)
The part of the Internet which is not accessible by a standard Internet connection.
Dark web
Evidence that an intrusion or security breach has taken place.
Indicators of compromise
An initiative by the DHS to facilitate the open and free exchange of IoCs and other cyberthreat information between the US federal government and the private sector in an automated and timely manner.
Automated indicator sharing (AIS)
A standardized language and repetitional structure for the organization and dissemination of cyberthreat indicators and related information.
Structured threat information expression (STIX)
A standardized set of communication services, protocols, and message exchanges to support the effective communication and exchange of cyberthreat indicators.
Trusted automated exchange of intelligence information (TAXII)
The collection of information about the means, motivations, and opportunities related to APTs.
Tactics, techniques, and procedures (TTP)
