- 2.1 - Compare and contrast common threat actors and motivations
- 2.2 - Explain common threat vectors and attack surfaces
- Understand attacker types, motivations, resources, and behavior
- Threat Actor
- Threat Actor Types
- Threat Actor Motivations
- Internal and External Threats
- Threat Vectors
- Attack Surface
- Deception and Disruption Technologies
- Key Takeaways
- Threat Actor: Person, group, or organization that can cause harm to systems, data, or operations.
- Threat actors may be intentional or unintentional.
- Understanding the threat actor helps determine likely tactics, techniques, targets, and impact.
- Unskilled Attacker: Uses common tools or scripts with limited knowledge.
- Hacktivist: Attacks for political, social, or ideological reasons.
- Organized Crime: Attacks for financial gain.
- Nation-State Actor: Advanced attacker sponsored by a government.
- Insider Threat: Current or former employee, contractor, or trusted partner who misuses access.
- Competitor: May attempt to steal intellectual property or business information.
Common motivations include:
- Financial gain
- Espionage
- Data theft
- Revenge
- Political beliefs
- Disruption or chaos
- War
- Ethical reasons
- Blackmail
Example:
- A ransomware group is usually financially motivated.
- A nation-state actor may be motivated by espionage.
-
Internal Threat: Comes from inside the organization.
- Example: Employee misuses access.
-
External Threat: Comes from outside the organization.
- Example: Attacker tries to brute force VPN credentials.
Insider threats can be:
- Malicious
- Negligent
- Accidental
- Compromised
- Threat Vector: Path or method used by a threat actor to attack.
Examples:
- Web application
- Removable media
- Voice call
- SMS message
- Cloud service
- Remote access portal
- Wireless network
- Attack Surface: All possible points where an attacker can attempt access or impact.
Examples:
- Public website
- VPN login page
- User accounts
- Email inboxes
- APIs
- Open ports
- Third-party integrations
- Honeypot: Decoy system used to attract attackers and observe behavior.
- Honeynet: Network of honeypots.
- Honeyfile: Decoy file used to detect unauthorized access.
- Honeytoken: Fake data or credential used to detect misuse.
- Threat actors differ by skill, motivation, funding, and access.
- Knowing the likely attacker helps choose better defenses and monitoring.