Ch 5 Threat Actors, Vectors, & Intelligence Sources

Question 1

Advanced Persistent Threats (APTs) Attack

Answer 1

• Characterized by using toolkits to achieve a presence on a target network, and instead of just moving to steal information, focusing on the long game by maintaining a persistent presence on the network.

Question 2

Insider Threats

Answer 2

• Insiders may already have all the access they need to perpetrate criminal activity such as fraud.

Question 3

State Actors

Answer 3

• Employed by the government to compromise or gain access to the intelligence data of targeted governments.
• Often carryout APT attacks.

Question 4

Hacktivists

Answer 4

Hackers working together for a collectivists effort, typically on behalf of some cause.

Question 5

Script Kiddies

Answer 5

• Individuals who do not have the technical expertise to develop scripts or discover new vulnerabilities in software.

Question 6

Hackers

Answer 6

• Anyone who improperly uses computers, including criminals.
• Current categories of Hackers include authorized, unauthorized, and semi-authorized.

Question 6

Criminal Syndicates

Answer 6

• Organized crime groups that have more money to spend on accomplishing the criminal activity.
• These groups usually fall into the structured threat category.

Question 7

Authorized Hackers

Answer 7

• “White Hat” hackers serving as consultants chasing vulnerabilities or performing penetration tests.
• Uses the same tools as a regular hacker but doing so with permissions so that a firm can learn its weakness and fix them.

Question 8

Unauthorized Hackers

Answer 8

• Considered to be “Black Hat” hackers act in an unauthorized manner and violate laws causing risk to systems.

Question 9

Semi-authorized Hackers

Answer 9

• “Gray Hat” hackers may perform the same actions as a “White Hat” hacker and “Black Hat” hacker.

Question 10

Shadow IT

Answer 10

• Groups perform that perform their own IT functions, when central IT does not respond in a reasonable time frame.
• Because it is outside the control of central IT, the IT systems are not in the same realm of protection.

Question 11

Competitors

Answer 11

• Other businesses that attack other firms IT processes.

Question 12

Attributes of Actors - Internal/External

Answer 12

• Internal actors have access to the system where as external actors have to take extra steps.

Question 13

Attributes of Actors - Resources/Funding

Answer 13

• Criminal organizations and nation-states have larger budgets, bigger teams, and the ability to pursue campaigns for longer periods of time.

Question 13

Attributes of Actors - Level of Sophistication/Capability

Answer 13

• As the skill level goes up, so too does the use of minimal methods.

Question 14

Attributes of Actors - Intent/Motivation

Answer 14

• A more skilled threat actor is usually pursuing a specific objective.

Question 15

Attributes of Actors - Vectors

Answer 15

• The attacker has direct access to the system.
• Only give the necessary permissions and blocking all others.
• All outside input is treated as dangerous until proven otherwise.

Question 16

Wireless

Answer 16

• Through wireless, the attacker no longer needs have direct physical access to the network.

Question 17

Supply Chain

Answer 17

• An attacker finds a means by which they can get their attack code into the supply chain for a product or an update.
• Cannot be stopped just by policy and contracts.

Question 17

E-Mail

Answer 17

• One of the preferred vectors for social engineering attacks.
• Users may click on links or open the attachments delivers the payload.

Question 18

Social Media

Answer 18

• Connects an attacker directly to a user.
• Many of the usual security checks normally used are not present.

Question 19

Removable Media

Answer 19

• Typically in the form of USBs.
• An attacker takes a USB storage device and puts the attacking module on it so that it can be executed.

Question 20

Cloud

Answer 20

• Cloud servers and storage can be considered attack vectors if your cloud agreement does not include antivirus protections on files.

Question 21

Threat Intelligence Sources

Answer 21

• The gathering of information from a variety of sources which can include open source to proprietary of specialized sources.