1.5 Explain different threat actors, vectors, and intelligence sources Flashcards
What is an internal/external threat actor?
An external threat actor or agent is one that has no account or authorized access to the target system. A malicious external threat must infiltrate the security system using malware and/or social engineering. Note that an external actor may perpetrate an attack remotely or on-premises (by breaking into the company’s headquarters, for instance). It is the threat actor that is defined as external, rather than the attack method.
Conversely, an internal (or insider) threat actor is one that has been granted permissions on the system. This typically means an employee, but insider threat can also arise from contractors and business partners.
What is the intent/motivation of a threat actor?
Intent describes what an attacker hopes to achieve from the attack, while motivation is the attacker’s reason for perpetrating the attack. A malicious threat actor could be motivated by greed, curiosity, or some sort of grievance, for instance. The intent could be to vandalize and disrupt a system or to steal something. Threats can be characterized as structured or unstructured (or targeted versus opportunistic) depending on the degree to which your own organization is targeted specifically. For example, a criminal gang attempting to steal customers’ financial data is a structured, targeted threat; a script kiddie launching some variant on the “I Love You” email worm is an unstructured, opportunistic threat.
Malicious intents and motivations can be contrasted with accidental or unintentional threat actors and agents. Unintentional threat actors represents accidents, oversights, and other mistakes.
What are the attributes for funding/sophistication of threat actors?
You must also consider the sophistication and level of resources/funding that different adversaries might possess. Capability refers to a threat actor’s ability to craft novel exploit techniques and tools. The least capable threat actor relies on commodity attack tools that are widely available on the web or dark web. More capable actors can fashion zero-day exploits in operating systems, applications software, and embedded control systems. At the highest level, a threat actor might make use of non-cyber tools, such as political or military assets. Capability is only funded through a substantial budget. Sophisticated threat actor groups need to be able to acquire resources, such as customized attack tools and skilled strategists, designers, coders, hackers, and social engineers. The most capable threat actor groups receive funding from nation states and criminal syndicates.
What is an authorized hacker?
A hacker engaged in authorized penetration testing or other security consultancy.
What is a semi-authorized hacker?
A gray hat hacker (semi-authorized) might try to find vulnerabilities in a product or network without seeking the approval of the owner; but they might not try to exploit any vulnerabilities they find. A gray hat might seek voluntary compensation of some sort (a bug bounty), but will not use an exploit as extortion. A white hat hacker always seeks authorization to perform penetration testing of private and proprietary systems.
What is a black hat hacker?
An unauthorized hacker operating with malicious intent.
What is a script kiddie?
A script kiddie is someone who uses hacker tools without necessarily understanding how they work or having the ability to craft new attacks. Script kiddie attacks might have no specific target or any reasonable goal other than gaining attention or proving technical abilities.
What is a hacktivist?
A hacktivist group, such as Anonymous, WikiLeaks, or LulzSec, uses cyber weapons to promote a political agenda. Hacktivists might attempt to obtain and release confidential information to the public domain, perform denial of service (DoS) attacks, or deface websites. Political, media, and financial groups and companies are probably most at risk, but environmental and animal advocacy groups may target companies in a wide range of industries.
What is an APT?
Advanced persistent threat: An attacker’s ability to obtain, maintain, and diversify access to network systems using exploits and malware. Rather than think in terms of systems being infected with a virus or Trojan, an APT refers to the ongoing ability of an adversary to compromise network security—to obtain and maintain access—using a variety of tools and techniques.
What is a state actor?
A type of threat actor that is supported by the resources of its host country’s military and security services.
State actors have been implicated in many attacks, particularly on energy and health network systems. The goals of state actors are primarily espionage and strategic advantage, but it has been known for countries—North Korea being a good example—to target companies purely for commercial gain.
What is a criminal syndicate?
A type of threat actor that uses hacking and computer fraud for commercial gain.
A criminal syndicate×
A type of threat actor that uses hacking and computer fraud for commercial gain.
can operate across the Internet from different jurisdictions than its victim, increasing the complexity of prosecution. Syndicates will seek any opportunity for criminal profit, but typical activities are financial fraud (both against individuals and companies) and extortion.
What is an insider threat?
A type of threat actor who is assigned privileges on the system that cause an intentional or unintentional incident.
What is an attack surface?
The points at which a network or application receives external connections or inputs/outputs that are potential vectors to be exploited by a threat actor.
What is an attack vector?
A specific path by which a threat actor gains unauthorized access to a system.
What are the seven types of threat vectors?
Direct access, removable media, email, remote and wireless, supply chain, web and social media and cloud.
- ) Direct access—this is a type of physical or local attack. The threat actor could exploit an unlocked workstation, use a boot disk to try to install malicious tools, or steal a device, for example.
2.) Removable media—the attacker conceals malware on a USB thumb drive or memory card and tries to trick employees into connecting the media to a PC, laptop, or smartphone. For some exploits, simply connecting the media may be sufficient to run the malware. In many cases, the attacker may need the employee to open a file in a vulnerable application or run a setup program.
3.) Email—the attacker sends a malicious file attachment via email, or via any other communications system that allows attachments. The attacker needs to use social engineering techniques to persuade or trick the user into opening the attachment.
4.) Remote and wireless—the attacker either obtains credentials for a remote access or wireless connection to the network or cracks the security protocols used for authentication. Alternatively, the attacker spoofs a trusted resource, such as an access point, and uses it to perform credential harvesting and then uses the stolen account details to access the network.
5.) Supply chain—rather than attack the target directly, a threat actor may seek ways to infiltrate it via companies in its supply chain. One high-profile example of this is the Target data breach, which was made via the company’s HVAC supplier (krebsonsecurity.com/2014/02/target-hackers-broke-in-via-hvac-company).
6.) Web and social media—malware may be concealed in files attached to posts or presented as downloads. An attacker may also be able to compromise a site so that it automatically infects vulnerable browser software (a drive-by download). Social media may also be used more subtly, to reinforce a social engineering campaign and drive the adoption of Trojans.
7.) Cloud—many companies now run part or all of their network services via Internet-accessible clouds. The attacker only needs to find one account, service, or host with weak credentials to gain access. The attacker is likely to target the accounts used to develop services in the cloud or manage cloud systems. They may also try to attack the cloud service provider (CSP) as a way of accessing the victim system.
