2 Cybersecurity Threat Landscape Flashcards
(85 cards)
What are the attributes of threat actors (IE SC RF MI)
IES CR FMI
Threat actors differ in several key attributes. We can classify threat actors using four major criteria. First, threat actors may be internal to the organization, or they may come from external sources. Second, threat actors differ in their level of sophistication and capability. Third, they differ in their available resources and funding. Finally, different threat actors have different motivations and levels of intent.
What sources can threat actors come from? (6)
1) unskilled attackers using exploit code written by others,
2) quite sophisticated, such as the advanced persistent threat posed by nation-state actors and organized crime
3) Hacktivists may seek to carry out political agendas,
4) whereas competitors may seek financial gain.
5) Employees and other users may pose an insider threat by working from within to attack your organization.
6) The use of unapproved shadow IT systems may also expose your data to risk.
What are motivations for Attackers? (9)
1) data exfiltration
2) espionage,
3) service disruption,
4) blackmail
5) financial gain
6) philosophical or political beliefs
7) revenge, disruption and
8) chaos, or war.
9) Some attackers may believe they are behaving ethically and acting in the best interests of society.
What vectors might Attackers exploit to gain initial access to an organization? (6) W P S M C S
1) remotely over the Internet, through a wireless connection,
2) or by attempting direct physical access. They may also approach employees over
3) email or social media.
4) Attackers may seek to use removable media to trick employees into unintentionally compromising their networks,
5) or they may seek to spread exploits through cloud services
6) Sophisticated attackers may attempt to interfere with an organization’s supply chain.
Threat intelligence provides organizations with valuable insight into the threat landscape. Where can Security teams may leverage threat intelligence from? (3) P&P I A
1) public and private sources to learn about current threats and vulnerabilities.
2) indicators of compromise and
3) predictive analytics on their own data
Threat intelligence teams often supplement open source and closed source intelligence that they obtain externally with their own research.
Security teams must monitor for supply chain risks - what should they pay particular attention to?.
Security teams must monitor for supply chain risks. Modern enterprises depend on hardware, software, and cloud service vendors to deliver IT services to their internal and external customers. Vendor management techniques protect the supply chain against attackers seeking to compromise these external links into an organization’s network.
Security professionals should pay particular attention to risks posed by
1) outsourced code development,
2) cloud data storage, and
3) integration between external and internal systems.
** techniques used for social engineering? **
1) Phishing
2) and its related techniques of smishing
3) and vishing seek to gain information using social engineering techniques.
4) Misinformation and disinformation campaigns are used to change opinions and to shift narratives.
5) Malicious actors will **impersonate **whomever they need to acquire information, to gain access or credentials, or to persuade individuals to take action.
6) Pretexting is often used with impersonation to provide a believable reason for the action or request.
7) Business email compromise and brand impersonation are both used to make malicious emails and other communications appear legitimate and thus more likely to fool targets into taking desired action.
8) Watering hole attacks focus on sites that target frequently visit, while
9) typosquatters rely on users who make typos while entering URLs.
What are ways to aquire and crack passwords? (O, O, B
1) Password attacks can be conducted both online against live systems and
2) offline using captured password stores.
3) Brute-force attacks like spraying and dictionary attacks as well as password cracking can recover passwords in many circumstances.
4) Unencrypted or plain-text passwords and** improper or unsecure storage methods** like the use of MD5 hashes make attacks even easier for attackers who can access them.
What are the main categories of cybersecurity threat actors?
Internal and External
Internal threats come from within the organization, while external threats originate from outside.
What does the term APT stand for?
Advanced Persistent Threat
APTs are often linked to nation-state attackers and involve sophisticated, ongoing attacks.
Who are white-hat hackers?
Authorized attackers who seek to discover and correct security vulnerabilities
They may be employees or contractors engaged in penetration testing.
What is a script kiddie?
A derogatory term for unskilled attackers who use automated tools for hacking
They often lack deep knowledge of hacking techniques.
What motivates organized crime in cyber activities?
Illegal financial gain
Organized crime groups typically do not embrace political causes.
What is shadow IT?
The use of technology services not approved by the organization
This often happens when employees seek to meet business needs independently.
What distinguishes hacktivists from other types of attackers?
They use hacking for activist goals and believe they are motivated by the greater good
Their activities may violate laws but are seen as justifiable.
Fill in the blank: APT attackers often conduct their own security vulnerability research in an attempt to discover _______.
[zero-day vulnerabilities]
What are insider threats?
Attacks by individuals with authorized access to information and systems
Insiders may have varying skill levels and motivations.
What is the primary focus of unskilled attackers?
Proving their skill by attacking convenient targets
They often target environments like schools.
What are the characteristics of organized crime in cyber activities?
- Motive: illegal financial gain
- Skill level: moderately to highly skilled
- Resources: more time and money than unskilled attackers
Organized crime groups are often involved in various cybercrime categories.
Which hacking group is most well-known for hacktivism?
Anonymous
They are known for collective decision-making regarding their agenda and targets.
True or False: All gray-hat hacking is legal.
False
Gray-hat hacking can still lead to criminal charges despite good intent.
What can behavioral assessments help identify?
Insider attacks
Cybersecurity teams should collaborate with HR to detect unusual behaviors.
What is a common tactic used by competitors for corporate espionage?
Using disgruntled insiders to steal sensitive information
Competitors may also purchase insider information on the dark web.
