SON 3 Flashcards
Threat actors?
Nation-state
Unskilled attacker
Hacktivist
Insider threat ◦ Organized crime
Shadow IT
What factor determines the financial strength of a threat actor?
Threat actors vary in resources, with nation-states having significant funding.
Where can threat actors originate from?
Internal vs External
What determines a threat actor’s level of sophistication?
Skill levels differ; nation-states and organized crime are highly skilled, while unskilled attackers have low capability.
What are the key characteristics of a nation-state threat actor?
🔹 Nation-State – Government-backed cyber actor.
🔹 Goals – Political, economic, or military advantage.
🔹 Well-funded & skilled – Uses top-tier resources.
🔹 APTs – Long-term stealth attacks for spying or disruption.
What defines an unskilled attacker, and why can they still be a threat?
🔹 Unskilled Attacker – Lacks expertise, uses others’ tools.
🔹 “Script kiddie” – Relies on pre-made scripts.
🔹 No new exploits – Can’t create advanced attacks.
🔹 Still dangerous – Easy tools + weak security = risk.
What are the key traits of organized cybercrime groups?
🔹 Organized Crime – Criminal groups using cyber attacks for profit.
🔹 Well-funded & strategic – Structured operations with advanced tools.
🔹 Common crimes – Fraud, identity theft, ransomware, data theft.
🔹 Targets – Banks, businesses, and individuals.
What motivates hacktivists, and how do they operate?
🔹 Hacktivist – Hacker driven by political or social causes.
🔹 Tech + activism – Uses hacking for protests.
🔹 Common attacks – Website defacement, DDoS, data leaks.
🔹 Goal – Raise awareness or disrupt targets.
Why are insider threats difficult to prevent?
🔹 Insider Threat – Risk from people inside an organization.
🔹 Types – Malicious (intentional harm) or unintentional (careless mistakes).
🔹 Hard to detect – Insiders already have legitimate access.
🔹 Example – Phishing victim or a rogue employee stealing data.
Why is Shadow IT a security risk?
Shadow IT – Unapproved tech used within an organization.
🔹 Bypasses IT oversight – No security checks or compliance.
🔹 Risks – Data breaches, non-compliance, security gaps.
🔹 Examples – Unauthorized cloud storage, personal software, unsanctioned apps.
How can attackers use messaging services to deliver threats?
🔹 Email – Used for phishing, malware, ransomware, and spam.
🔹 SMS (Smishing) – Phishing links or malicious content via text.
🔹 Instant Messaging (IM) – Malware or phishing attacks in real-time chats.
How can attackers use messaging services to deliver threats?
🔹 Email – Used for phishing, malware, ransomware, and spam.
🔹 SMS (Smishing) – Phishing links or malicious content via text.
🔹 Instant Messaging (IM) – Malware or phishing attacks in real-time chats.
How can images be used as a cyber threat vector?
🔹 Malicious Images – Exploits can be hidden in image files.
🔹 Viewing = Risk – Simply opening an infected image can trigger an attack.
Question: Why is opening untrusted files a security risk?
🔹 Embedded Malware – Files can contain hidden malicious software.
🔹 Execution = Compromise – Opening an infected file can lead to an attack.
What is vishing, and how do attackers use it?
🔹 Vishing – Phone-based phishing scams.
🔹 Tricks victims – Attackers impersonate trusted entities.
🔹 Goal – Steal personal info or spread malware.
Why are USBs and other removable devices a security risk?
🔹 USBs & External Devices – Can carry malware.
🔹 Plugging in = Risk – May exploit system vulnerabilities.
🔹 Common attack – Auto-run malware when connected.
How do vulnerabilities in software expose systems to attacks?
🔹 Client-based – Installed software can have exploitable flaws.
🔹 Agentless – Runs without installation, harder to monitor.
🔹 Risk – Unpatched or outdated software increases threats.
