Individual or entity responsible for incidents that impact security and data protection.
Motivations
Intent represents the what (the objective, such as stealing data),
Motivation represents the why (the driving force, such as financial gain or ideology).
Data Exfiltration
Unauthorized transfer of data from a computer.
Attackers want sensitive information (PII, trade secrets, etc. can be sold on the dark web, used for identity theft, or leveraged for a competitive advantage).
Financial Gain
One of the most common motivations for cybercriminals (e.g., ransomware, banking trojans).
Blackmail
Attacker obtains sensitive or compromising information and threatens to release this information to the public unless certain demands are met.
Service Disruption
Often achieved by using a DDoS attack to overwhelm a network/service/server so that it becomes unavailable to its normal users.
Philosophical or Political Beliefs
Hacking used to promote a political agenda, social change, or to protest against organizations they perceive as unethical.
Typically targets political, financial, and media industries.
Ethical Reasons
Motivated by a desire to improve security.
Authorized hackers.
Revenge
An employee who is disgruntled may want to harm their current/former employer by leaking data or disrupting services.
Disruption or Chaos
Some hackers do it for the thrill, to challenge their skills, or simply to cause harm.
Unauthorized hackers.
Espionage
Involves spying to gather sensitive or classified information.
Usually motivated by a nation-state, rival business, or hacktivists.
War
Cyberattacks have increasingly become a tool for nations to attack each other on and off the battlefield.
Motivated by geopolitical objectives.
Attributes
Internal vs. External
Internal Threat Actors: Individuals or entities within an organization who pose a threat to its security.
External Threat Actors: Individuals or groups outside an organization who attempt to breach its cybersecurity defenses.
Resources and Funding
Refers to the tools, skill, and personnel at the disposal of a given threat actor.
Greatly influences the scale, frequency, and sophistication of attacks.
Level of Sophistication and Capability
Refers to technical skill and complexity of tools and techniques used and ability to evade detection and countermeasures.
Low sophistication threat actors typically use widely available tools and techniques like common malware or phishing attacks.
High sophistication threat actors possess advanced technical skills and use sophisticated tools and techniques.
Aside: Sophistication v. Capability
Capability: The ability to develop unique exploit tools.
Sophistication: The complexity of the tools used.
(A low-capability threat actor can sometimes do high-sophistication attacks with the right tools)
Types of Attackers
Unskilled Attackers
Individual who lacks the technical knowledge to develop their own hacking tools or exploits.
Tend to be more opportunistic and focus on easy targets.
Usual Motivations:
Desire for recognition.
Thrill of causing disruption to a organization’s network.
Less-likely to be motivated by financial gain or political ideologies.
Remember: Significant damage can still be caused with readily available tools and exploits.
Hacktivists
Use their technical skills to promote a cause or drive social change instead of personal gain.
Tend to demonstrate a fairly high level of sophistication.
Usual Methods:
Website defacement
DDoS
Doxxing
Leaking other sensitive data
Organized Crime
Sophisticated and well-structured entities that leverage resources and technical skills for illicit financial gain (via data breaches, identity theft, online fraud, and ransomware attacks).
Very adaptable and known to exploit novel technologies.
Target small/medium-sized businesses and high net worth individuals.
May be hired by governments to conduct attacks on their behalf.
Usual Methods:
Custom malware
Ransomware
Sophisticated phishing campaigns
Nation-State Actors
Groups that are sponsored by a government to conduct cyber operations against other nations, organizations, or individuals.
Sometimes operate as independent entities with state-backed resources so countries can maintain plausible deniability.
Sometimes attempt false flag attacks (an attack that is orchestrated to appear to originate from a different source or group).
Usually become Advanced Persistent Threats (APT) (term that used to be synonymous with nation-state actor because of their long-term persistence and stealth. Though now organized cybercrime can also be APTs).
Usual Motivations:
Gathering intelligence
Disrupting critical infrastructure
Influencing political processes
Aside: Most nation-state actors are not aiming for financial gain.
Usual Methods:
Custom malware
Zero-day exploits
Insider Threats
Cybersecurity threats that originate from within the organization (e.g., current and former employees, contractors, business associates).
Have an intimate knowledge of the organization’s infrastructure.
Have varying levels of capabilities (A skilled intern may be able to cause more damage than an unskilled system administrator).
Usual Methods:
Data theft
Sabotage
Misuse of access privileges
Facilitating external threats
Usual motivations:
Financial gain (e.g., selling sensitive data)
Revenge
Carelessness / lack of awareness of cybersecurity
Shadow IT
The use of IT systems, devices, software applications, and services without explicit organizational approval.
Can occur when security posture is too high and employees find workarounds for convenience (e.g., browser plugins and extensions).
Is not restricted to hardware and BYOD (bring your own device) but also software (e.g., using a personal cloud to store documents).
Usual Methods:
Use of personal devices for work purposes
Installation of unapproved software
Use of cloud services that have not been approved by the organization
Remember: Shadow IT is dangerous because you cannot secure or ensure compliance on something you do not know exists. A balance must be struck to avoid harming business operations.
Threat Vectors and Attack Surfaces
Threat Vector
Means or pathway by which an attacker can gain unauthorized access to a computer or network to deliver a malicious payload or carry out an unwanted action.
Attack Surface
Encompasses all various points where an unauthorized user can try to enter data or extract data from an environment.
Reducing Attack Surface:
Restricting Access
Removing Unnecessary Software
Disabling Unused Protocols
Common Threat Vectors
Messages: Include threats delivered via email, SMS, or other forms of instant message. Phishing campaigns are a common message-based attack vector.
Images: Involve the embedding of malicious code inside an image file.
Files: Involve use of malicious files to deliver a cyber threat.
Voice Calls: Involve use of voice calls to trick victims into revealing sensitive information (vishing).
Removable Devices: Threats delivered via removable devices like USB or other external devices.
Unsecure Networks: Refer to the lack of appropriate security measures to protect networks (e.g., Bluetooth, improperly secured Wi-Fi).
Outsmarting Threat Actors
Tactics, Techniques, and Procedures (TTPs)
Specific methods and patterns of activities or behaviors associated with a particular threat actor or group of threat actors.
Deception & Disruption Technologies
Designed to mislead, confuse, and divert attackers from critical assets while simultaneously detecting and neutralizing threats. Used by cybersecurity experts to learn threat actors’ TTPs.
Honeypots: Decoy system or network set up to attract potential hackers. Can be used against insider threats to detect fraud, snooping, and malpractice. Logs all actions done on them to learn about attackers.
Honeynets: Network of honeypots that mimics an entire network of systems, including servers, routers, and switches. Used by large organizations and research institutions.
Honeyfiles: Decoy file placed on a system to lure potential attackers. Some honeyfiles are malware that are intended to run on attackers’ machines and phone back information like their enumerated network topology. Honeyfiles can also be normal files that are merely embedded with unique identifiers or watermarks that identify the source of the file.
Honeytokens: Piece of data or a resource that has no legitimate value or use but is monitored for access or use. Useful for detecting insider threats.
Remember: A configured honeypot/honeynet could reveal to the attacker how your production systems are configured; they are a double-edged sword.