Sec+ Chapter 02: Cybersecurity Threat Landscape Flashcards
f
Script kiddie
People who use hacking techniques but have limited skills
Lack of skill != not dangerous
Relies on free or automated tools from the internet, but those are impactful if you’re vulnerable
Hactivists
Hackers who want to accomplish a specific goal
They believe they’re engaged in a just crusade, so your defense might not impact them the same way it would other threat actors
Organized cybercriminals
Threat actors or groups that want to generate as much illegal profit as they can
Can be moderately or highly skilled, but have a lot of resources and money to buy the best hackers they can
APT
Advanced persistent threats
Attackers that use advanced techniques and persist in their attacks, which occur over a significant period of time
Nation state attack
Governments or nations that engage in attacks
EX: China and Russia botnets for DDoS
Zero day attack
Attacks that exploit a vulnerability not known to other attackers or cybersecurity teams
Usually carried out by APT
Insider atack
Employee, contractor, vendor, or someone with access uses their permissions to attack an org
Shadow IT
When someone seeks out their own tech solutions instead of using company approved ones
EX: What I did with my home computer vs laptop at Classy during pandemic
Competitor attack
When competitors engage in corporate espionage to steal sensitive info and use it to their business advantage
Threat vectors
1) Email and social media
2) Direct access
3) Wireless networks
4) Removable media
5) Cloud
6) Third party / supply chain
Threat intelligence
Activities and resources available to learn about changes in the threat environment
OSINT
Open source intelligence
Intel acquired from publicly available sources
Closed source intelligence
When commercial, govt, or security orgs do their own research and maintain threat feeds with custom tools, analysis models, etc
3 questions to assess threat intel
1) Is it timely?
2) Is it accurate?
3) Is it relevant?
STIX
Structured threat information eXpression
XML language that defines things like motivations, abilities, capabilities, attack patterns, identities, malware, threat actors, tools, etc
Currently STIX 2.0
