1.5 Explain different threat actors, vectors, and intelligence sources Flashcards
Advanced persistent threat (APT)
Highly motivated group of attackers funded by a nation state
Insider threat
Someone on the inside of an org. violating company security policy
State actor
Attacker operating on behalf of nation state
Generally is an APT group
Hacktivist
Using hacking skills for a cause/purpose
Script kiddies
Threat actor less knowledgeable than a skilled attacker, usually uses tools with little understanding
Criminal syndicate
Organized cybercrime
Types of hackers
White hat
-Authorized hacker, for testing
Black hat
-Unauthorized hacker, malicious
Gray hat
-Semi-authorized hacker, under cover for ethical hacking
Shadow IT
Term used to describe IT components deployed by a department w/o knowledge or permission of senior mgt or IT group
Competitors
Another type of threat actor related to business or organization
Attributes of actors
Internal/external
Level of sophistication/capability
Resources/funding
Intent/motivation
Vectors
Path/means by which an attack gains access to a target to cause harm
Direct access
Wireless
Supply chain
Social media
Removable media
Cloud
Open source intelligence (OSINT)
Gathering of info from publicly available sources
Vulnerability databases
Indexes/repositories of info about threats, exploits, and attacks
Example:
Common Vulnerabilities and Exposures (CVE)
National Vulnerability Database (NVD)
Public/private information sharing centers
Locations where info about security compromise events are posted
Dark web
Part of internet not accessible by standard users
Indicators of compromise (IOCs)
Evidence of intrusion or breach
Automated indicator sharing (AIS)
Initiative by Department of Homeland Security to facilitate exchange of IoCs and other cyberthreat info between Gov. and Private sectors automatically
Structured threat information exchange (STIX)/Trusted automated exchange of indicator information (TAXII)
Effort to develop standard language and structure for cyberthreat indicators and related info
Predictive analysis
Using IoCs and other observables to attempt to predict an attack
Threat maps
Real time map of cyber attacks taking place
Request for commends (RFC)
Document drafted by technical community defining technology specs
Adversary tactics, techniques, and procedures (TTP)
Collection of info on means, motivations, and opportunities related to APTs
