1.5 - Threat Actors, Vectors, and Intelligence Sources Flashcards
1
Q
Threat Actor
A
- The entity responsible for an event that has an impact on the safety of another entity
- aka malicious actor
- broad scope of actors and motivations vary greatly
2
Q
APT
A
- Advance Persistent Threat
- Goal of most threat actors
- Attackers are in the network and undetected
- Can take along time to identify that an APT exists
- Average in:
- N. America (71 days)
- Europe, Middle East, Africa (177 days)
- Asia Pacific (204 days)
3
Q
Insiders
A
- Very dangerous threat actors
- Have a lot of control
- Sophistication may not be advanced, but it has institutional knowledge
- Ex: where data center is, network design
- They can direct their attacks, big advantage
4
Q
Nation State
A
- Usually a government
- In charge of national security (usually external gov’t)
- Have a lot of resources, high sophistication
- Constant attacks, commonly a APT (advance persistent threat)
5
Q
Hacktivist
A
- Hacker with a purpose
- often social / political
- Usually sophisticated with a specific target
- not usually a financial gain
- usually has to go outside for funding
6
Q
Script Kiddies
A
- Runs pre-made scripts without any knowledge of what’s happening
- Not necessarily a young person
- simple scripts
- Usually an external actor, but not overly sophisticated
- throwing a lot of different scripts at a system and hoping one sticks
- doesn’t often have a financial gain, looking for low hanging fruit
- often looking for bragging writes
7
Q
Organized Crime
A
- Professional criminals
- motivated by money
- almost always external entity
- very sophisticated
- can be highly organized (ex: one person sells data, one exploits, another handles customer support)
- lots of capital to fund hacking efforts
8
Q
Hacker
A
- Very broad definition
- An expert with technology
- Could be good or bad
- Often driven by money, power, ego
9
Q
Ethical Hacker
A
- Authorized
- Has permissions to hack
- help resolve weak points to help make the system stronger
10
Q
Semi-authorized Hacker
A
- In the middle of an authorized and unauthorized hacker
- may be looking for vulnerability but doesn’t use it
11
Q
Shadow IT
A
- Going rogue
- working around the internal IT organization
- Create your own IT entity
- Sometimes ppl who doesn’t understand IT policies will see them as road blocks
- Ex: Purchasing own cloud resources or own equipment
- may be short term benefits, there are often significant disadvantages (waste time and money, IT dept can usually do things faster, security risks, compliance issues)
12
Q
Competitor motivation
A
- Could be DoS, espionage, tarnish reputation
- Usually significant resources b/c can be private entities
- Can gain competitive advantage (very unethical)
13
Q
Attack Vector
A
- Method attacker will use to get access to target
- Attackers spend a lot of time to find these vectors
- IT professionals will spend a lot of time watching attack vectors
14
Q
Direct Access Attack Vectors
A
- If attacker has physical access they have a lot of access
- Reason why data centers are highly secure
- Ex: can reset administrator password
- Key logger to keyboard (can collect user names and passwords)
- Connect a flash drive / portable media and copy files
- DoS, pull power cord, pour water on system
15
Q
Wireless attack vectors
A
- Usually have user name / passwords, don’t use default credential
- Ex: Rogue access point, unauthorized access point, then they could turn on wide open access point
- Ex: Evil twin (more malicious version of a rogue access point) for man in the middle attack. Then can use an on path attack
- Want to ensure clients are using the latest protocols, older encryption protocols (like WEP and WPA) you want to run WPA2 or later on wireless attack points
16
Q
Email attack vectors
A
- Biggest/ most successful attack vectors
- Everyone has email
- Phishing attacks, people want to click links, can deliver malware, social engineering attacks (invoice scam)
17
Q
Supply chain attack vectors
A
- Each step along the supply chain is an attack vector
- Can tamper with underlying infrastructure
- Many third parties involved
- Ex: fake cisco switches
