2.1 Flashcards
Threat actors
An entity responsible for an event that has an impact on the safety of another entity
Threat actor
AKA malicious actor
3 types of threat actor categorization
Internal/external
Resources/funding
Level of sophistication/capability
A threat actor backed by governments/government agencies
Motivations of data exfiltration, philosophical, revenge, disruption, war
External
Often an APT
Very high sophistication
Nation state
A threat actor who runs pre-made scripts without any knowledge of what’s really happening
Motivated by the hunt - disruption, data exfiltration, sometimes philosophical
Can be internal or external
Not very sophisticated
No formal funding - looks for low-hanging fruit
Unskilled attacker
A threat actor with a purpose
Motivated by philosophy, revenge, disruption, etc.
Often external, but may also be an insider threat
Can be remarkably sophisticated
Limited funding
Hacktivist
A threat actor who uses their privileged knowledge of an organization to attack that organization
Motivated by revenge or financial gain
ALWAYS internal
Extensive resources - uses the org’s own resources against them
Medium level of sophistication - has institutional knowledge
Insider threat
A threat actor compromised of professional criminals. They perform their crime in an organized way: one person hacks, another manages exploits, another sells the data, another handles customer support, etc.
Motivated by money
Almost always external
Very sophisticated - need the skills to back up their pay
Lots of capital to fund hacking efforts
Organized crime
A threat actor that is a group or department that works around the existing policies/procedures of the IT department in an organization. They may build their own infrastructure, install their own applications, and start using them without the IT department realizing what is happening. They are not under the limitations of change control, security policies, and the org’s budget.
Motivated by philosophical beliefs, revenge
Internal
Limited resources
Medium sophistication - may not have IT training/knowledge, makes it more insecure
Shadow IT
Name the threat actor
Location: external
Resources: extensive
Sophistication: very high
Motivations: data exfiltration, philosophical beliefs, revenge, disruption, war
Nation state
Name the threat actor
Location: external
Resources: limited
Sophistication: very low
Motivations: disruption, data exfiltration, philosophical beliefs
Unskilled attacker
Name the threat actor
Location: external
Resources: some funding
Sophistication: can be high
Motivations: philosophical beliefs, revenge, disruption/chaos
Hacktivist
Name the threat actor
Location: internal
Resources: many resources
Sophistication: medium
Motivations: revenge, financial gain
Insider threat
Name the threat actor
Location: external
Resources: many resources
Sophistication: very high
Motivations: financial
Organized crime
Name the threat actor
Location: internal
Resources: many resources
Sophistication: limited
Motivations: philosophical beliefs, revenge
Shadow IT
