- Welcome to lesson five,
compare and contrast common threat actors and motivations.
In this lesson, we're gonna focus in
on who those threat actors are
and attributes that we understand their motivation
and how they work and why they do the things that they do.
But before we talk about threat actors,
let's just do a threat primer.
Some of this is review, but I wanna make sure
that we're using terminology in the same way.
So let's review threats, vulnerabilities, and exploit.
A threat is a category of objects, persons, processes
or events that represent a potential danger
and that's the key
that it represents a potential danger to an asset.
Next, we have vulnerabilities.
Now, a vulnerability is a weakness in a system,
in a process, in a person.
Could also be in a building, in infrastructure,
that can be exploited by a threat.
So vulnerability is our weakness.
And then lastly, we have an exploit.
An exploit is where our threat actor
successfully takes advantage of the vulnerability.
That's when they're doing their really nasty things.
They're looking to do us harm.
So a threat is a danger, a vulnerability is a weakness
and exploit is when our threat actor takes advantage
successfully takes advantage of the vulnerability.
So before I actually introduce you to our threat actors
or adversaries, let's do adversary primer.
A threat actor agent, a targeted attack,
and an opportunistic attack.
Now, an adversary is an opponent.
A threat actor is going to be an adversary
with malicious intent, right?
They want to do some harm.
Now, our adversaries or our threat actors, right?
Really have two approaches.
They can either approach us as a targeted attack victim
or an opportunistic attack victim.
So let's define a targeted attack
and an opportunistic attack.
A targeted attack is when our threat actor chooses a target
for a specific objective.
So they know they're coming after you specifically
and the choice of that target is generally influenced
by the perceived value of the outcome.
They don't know what your weaknesses are,
they don't know how they're necessarily
going to be successful in their attack,
but they know they wanna come after you.
So very specific.
That's different than an opportunistic attack.
In an opportunistic attack,
the threat actor takes advantage of a vulnerable target
perhaps not previously ever even known to them.
Now, the choice of their target
is going to be generally influenced by the work factor.
So let me give you a couple examples.
In the physical world,
maybe there's a robber
who wants to rob a store on Main Street.
He gets to the first store
and it's really well lit up
and looks like there's a a CCTV camera.
They're like, "I'm not doing that one."
Goes to the next door, and boy, big deadbolts
and, "Oh, looks like there's even a security guard.
Not doing that one."
Gets the next one, alarms really well lit up.
I mean, it looks like it's tight put together.
Well, probably not a good chance
of being successful there either.
Gets to the fourth one, no security guard around,
doesn't look like there's a CCTV camera,
doesn't look like there's an alarm.
The lock looks like, "Oh, I could probably get through it.
Aha, there's the opportunity."
So that's the victim that the attacker chooses.
That's an opportunistic attack.
You know, in the digital world, it could be as simple
as our attackers are scanning the internet,
they're looking for open ports, they're looking
for organizations or infrastructures
that don't particularly look very well locked down.
They say, "Oh, that would be an opportunistic target."
So in a targeted attack, right,
the attacker's going right after that target, right?
Generally influenced by the perceived value of the outcome.
In an opportunistic attack, the choice
of the target is going to be generally influenced
by the work factor, right?
How much time and effort and resources
do they have to put in to be successful in that attack?
So let's talk about our cyber threat actors.
We have a whole pan on them.
We might have a just a lone skilled
or unskilled attacker kind of just working on their own.
We could have a hacktivist.
Now a hacktivist is really interested
in making a political statement.
Favorite activities of a hacktivist
is going to be doing a defacing a website
or a distributed denial of service attack.
We could have organized crime
that we refer to as cyber criminals.
And these are criminals who are out to make money, right?
Money is, you know, their real motivation.
And this is an area that's scary
because they're very, very well-organized.
There's an incredible cyber criminal ecosystem
and they put a lot of money into R&D.
We have nation states.
So it could be nation states
who are looking to disrupt another nation.
It could be to cause some harm,
it could be to steal some intellectual property,
it could be to steal some military secrets,
or it could be just to instill fear.
We have insiders, right?
Insiders who, you know, may feel like they have a grievance
or there's a moral obligation,
there's something that they think is wrong
and they've brought it to the attention of management
and they've been ignored.
Or maybe they're someone who is really under duress
and so they're being pressured into taking an action.
Or it could be really as simple as shadow IT
which is using technology sort of outside of the sphere
of the IT department
so they haven't applied the appropriate controls.
And then we have competitors.
Competitors really want to do one of two things.
Either they'd like to get intellectual property,
so learn what you're doing,
or, and we see this a lot in gaming and retail,
knock the other site offline.
Because if you can knock a gaming site
or a retail site offline,
it's a good chance that those customers
or those players will go to another site
develop loyalty at the other site, and not come back.
So lone skilled or unskilled attackers,
hacktivists, organized crime, nation states,
insiders, and competitors.
But that's a lot of threat actors.
That's the bad news.
The good news is that generally speaking,
they all use the same tools and techniques.
They're all looking to exploit
relatively the same vulnerabilities.
They're just doing it to different levels of sophistication.
So as we learn to defend against one of these threat actors,
we actually are learning to defend against all of them.
So let's dive a little bit more
into their means and motive.
So we talked about
these lone skilled or unskilled attackers.
Our unskilled detectives,
we often refer to as script kitties.
Now, script kitties are those
who don't have any coding skills,
maybe not have any cyber skills
they're just bringing down tools from the internet.
They know how to go to the internet, maybe to the dark web.
They bring down a tool
and they're out there trying to attack.
Often, they don't even understand all the consequences
or ramifications of what they're doing.
Why do they do it?
Usually bragging rights and notoriety.
But they have generally,
a pretty low level of sophistication.
Then we have hackers.
Now, hackers, now we're talking not ethical hackers,
not those who hire to do good things
but these are hackers with not so great intent.
You know, very often what they're looking for
is some financial gain, right?
They wanna say to a company, "Hey, you know,
I can exploit you unless you pay me an amount."
Notoriety.
But generally, they're very talented.
And then we have hacktivists.
And the hacktivists usually aren't a single person.
A hacktivist usually works
in a group or as a collective, like Anonymous.
They wanna make a political statement.
Generally, they've got some talent.
Their funding is kind of variable.
But as I mentioned before, again,
they're trying to make a statement
and they really have two favorite avenues of attack,
doing denial of service
or distributed denial of service attacks
or defacing a website.
Then we go to our cyber criminals.
Again, financial gain, and that's their motive.
They're well organized, they're sophisticated,
and they're very well-funded.
Nation states.
There's a whole bunch of reasons why nation states
might be attacking.
Surveillance, espionage, disruption, war, all motivations.
They're very well-organized, they're sophisticated.
Generally, they are well-funded.
They can be stealthy because on the most part,
nation states have the luxury of time, right?
They can build up an attack
over days, weeks, months, even years.
Our insiders, grievance, revenge,
a perceived morality issue, duress, blackmail.
A whole bunch of different reasons why insiders
might cause trouble for us.
And they have a variable level of sophistication
and funding, really depending on who they are.
It could be anyone
from a IT administrator to perhaps our bank teller.
Shadow IT was when someone is trying to accomplish a task
but they're bypassing the controls
that the IT group would put in place.
We'll be talking more about shadow IT in just a little bit.
There's no malice there,
but they are circumventing the controls
and that could cause problems for us.
And then of course, our competitors.
Espionage, IP theft, service disruption,
reputational damage.
Generally, if a competitor is going to come after you,
they're usually pretty sophisticated
or hired some pretty sophisticated folks
and they are well-funded.
So that's some means and motive
for all of these different threat actors.
Now, there are also some non adversarial threats.
Remember, an adversary was an opponent.
So this is a non-opponent type of threat
that could cause harm to our organization.
There are natural non-adversarial threats.
natural occurrences like earthquakes and storms and floods.
Environmental events like pollution
and sea rise or public health emergencies
like the pandemic that we've all gone through.
There are operational non-adversarial threats,
loss of services like electricity or HVAC,
or technical issues like equipment
or communications failure.
And lastly, human non-adversarial threats.
Things like accidents
or civil disturbances or work shortages.
But even though they're non-adversarial
doesn't mean they're not a danger.
So we still have to prepare for them.
And that, my friends, brings us to a three second challenge.
You know how to do this.
Five challenge questions, three seconds each.
Let's do it.
The term used to describe when a threat agent
successfully takes advantage of a vulnerability.
One, two, three.
That's gonna be an exploit.
Number two.
The primary characteristic of this attack
is a threat actor identifying
a vulnerable target for exploit.
So the threat actor
for seeing they're doing is identifying
a vulnerable target that they're going to exploit.
One, two, three.
It's gonna be an opportunistic attack.
Number three.
IP theft, reputation, damage and disruption
are this attacker's group's motivation.
IP theft, reputation damage, disruption.
Of the attacker groups that we talked about,
which one of them is this their motivation?
One, two, three.
That's gonna be our competitors.
Number four.
Highly motivated, well-funded adversary
whose motive is financial gain.
This is a really scary group.
One, two, three.
And that's our cyber criminals or organized crime.
And number five.
The time, effort, and resources required
to accomplish a task.
What's the term we use to describe
the time, effort and resources required
to accomplish a task?
One, two, three.
And that's gonna be our work factor.
All right, let's do a security in action
and practically apply our knowledge.
This one's about insider activity.
You notice that one of your coworkers work habits
have changed dramatically.
He's coming in earlier than usual, and he's staying later.
He's intently focused, he's asking unusual questions
and he becomes unusually defensive
when questioned about his work.
Very uncharacteristically,
he canceled his long-planned vacation.
Now, your supervisor doesn't seem at all concerned
and to the contrary,
has been praising your coworker's initiative and output.
Is your concern warranted?
And if so, what should you do?
So you notice that something's going on
and you're just you don't feel right about it, right?
And with all these things happening, the question is,
is there something to be concerned about here?
Is your concern warranted?
And if so, what are you gonna do?
Go ahead, put me on pause.
Think about this for a minute, jot down your response,
then come back and we'll do it together.
Well, absolutely, yes, your concern is warranted.
Cybersecurity measures are frequently focused
on threats outside the organization
rather than threats inside the organization.
We hate to think about the fact
that we might have untrusted worthy people
inside our organization, but the truth
is that insiders have caused irreparable harm
to organizations as well as to national security interests.
So you should document your concerns
and report your concerns to the HR department.
Obviously, your supervisor's okay with it.
So go to the HR department, document first,
if these are the things you're concerned about,
the HR department will keep this confidential
and then report those concerns to the HR department.
Now, if that's not an option,
perhaps you don't have an HR department
then you should discuss your concerns
with a member of senior management.
And in either case, when you go to them,
they might be really dismissive at first.
And so your job is going to educate them
on threat actors specifically,
or especially in this case, insider threats.
And being able to have those conversations,
that my friends, is security in action.
That brings you to your word cloud.
You know what to do, right?
Make sure you can go through all of these terms.
You can explain them, you understand them,
you can teach somebody else what they mean.
When you're ready,
head on over to the next lesson, 5-2
and I'll be waiting for you right there.