2.1Compare and contrast common threat actors and motivations

Question 1

Type of Threat actors

Answer 1

• Nation-state
• Unskilled attacker
• Hacktivist
• Insider threat
• Organized crime
• Shadow IT

Question 2

what is a Threat Actor

Answer 2

individual or entity that’s responsible for incidents that impact security and data protection.

Question 3

Unskilled Attackers

Answer 3

Unskilled Attackers are individuals
with limited technical experience
who use readily available tools like downloaded scripts,or exploits to carry out their attacks

Question 4

Nation-state Actor

Answer 4

● Highly skilled attackers sponsored by governments for cyber espionage or
warfare

○ Sometimes, these threat actors attempt what is known as a false flag attack

Question 5

Advanced Persistent Threat (APT)

Answer 5

used synonymously with a nation-state actor because of
their long-term persistence and stealth

A prolonged and targeted cyberattacks, undetected for an extended period

Question 6

What motivates a nation-state actor?

Answer 6

to achieve their long-term strategic goals, and
they are not seeking financial gain

Question 7

False Flag Attack

Answer 7

an attack that appears to originate from
a different source or group than the actual perpetrators

Question 8

Attributes of threat actors : characteristics

Answer 8

• Internal/external : within and outside an organization
• Resources/funding : Tools, skills, and personnel at the disposal of a given threat actor
• Level of sophistication/capability : Refers to their technical skill, the complexity of the tools and techniques they
  use, and their ability to evade detection and countermeasures

Question 9

lowest skilled threat actors

Answer 9

Script Kiddie
○ Individual with limited technical knowledge
○ use pre-made software or scripts to exploit computer systems and
networks

Question 10

Advanced technical skilled threat actors

Answer 10

Nation-state actors, Advanced Persistent Threats and others have high levels of
sophistication and capabilities and possess advanced technical skills

Question 11

Threat actors Motivations

Answer 11

• Data exfiltration : Unauthorized transfer of data from a computer
• Espionage : spying to gather sensitive or classified information
• Service disruption : disrupt the services of various organizations,
  either to cause chaos, make a political statement, or to demand a ransom
• Blackmail : obtains sensitive or compromising information threatens to release unless certain demands are met
• Financial gain : h various means, such as ransomware attacks, or through
  banking trojans
• Philosophical/political beliefs :known as hacktivism
• Ethical : Authorized hackers, are motivated by a desire to improve security
• Disruption/chaos : spreading malware to launching sophisticated cyberattacks
  against the critical infrastructure
• War : disrupt a country’s infrastructure, compromise its national security, and to cause economic damage

Question 12

Hacktivists

Answer 12

cyber attackers driven
by political, social, or environmental ideologies, who often want to draw attention to a specific cause.

Question 13

To accomplish their objectives, hacktivists use a wide range of techniques such as :

Answer 13

• Website Defacement : electronic graffiti
• Distributed Denial of Service (DDoS) Attacks: overwhelm
• Doxing : public release of private information about an individual or
  organization
• Leaking of Sensitive Data

Question 14

Most well-known hacktivist groups is known as

Answer 14

Anonymous
● Loosely affiliated collective that has been involved in numerous
high-profile attacks over the years for targeting organizations that they
perceive as acting unethically or against the public interest at large

Question 15

Organized Crime

Answer 15

refers to well-structured groups
that execute cyber attacks for financial gain, usually through methods like ransomware,
identity theft, or credit card fraud, data breaches, online fraud

may be hired by other entities, including governments, to conduct
cyber operations and attacks on their behalf

Question 16

Insider Threats

Answer 16

originate from within the organization,

driven by
- revenge
- financial gain
- carelessness or a lack of awareness

Question 17

To mitigate the risk of an insider threat being successful

Answer 17

organizations should
implement the following

● Zero-trust architecture
● Employ robust access controls
● Conduct regular audits
● Provide effective employee security awareness programs

Question 18

Insider threats can take various forms

Answer 18

■ Data Theft
■ Sabotage
■ Misuse of access privileges

Question 19

Shadow IT

Answer 19

which refers to Information Technology Systems, devices, software,applications and services that are managed and utilized
without explicit organizational approval

and can pose a security risk to your organization.

Question 20

Threat Actors Intent

Answer 20

● Specific objective or goal that a threat actor is aiming to achieve through their attack

Question 21

Threat Actors Motivation

Answer 21

● Underlying reasons or driving forces that pushes a threat actor to carry
out their attack