- So, welcome to our Lesson 5 Deep Dive Quiz.
Lesson 5 was all about comparing and contrasting
threat actors and motivations.
We did two lessons, Lesson 5.1
Threat Actors and Attributes,
and Lesson 5.2
Threat Modeling and Intelligence.
So now let's answer five questions together.
You ready to get started?
Okay, let's do it.
Our first question,
this sophisticated adversary's motivation is financial gain
and generally has significant resources.
An organized crime syndicate, a nation state,
a hacktivist collective, or a competitor?
So now we're looking for two things, right,
for this sophisticated adversary, right?
Financial gain, and they generally have
significant resources.
So, look through this list.
First, determine who wants financial gain,
and then who has resources.
Organized crime, nation state,
hacktivist collective, or a competitor.
Are you ready?
Alright, well, I'm gonna choose organized crime.
Organized crime's motivation is always financial gain,
and they generally have some very good
and significant resources.
They put a lot of money into R&D.
Nation state's not really looking for financial gain,
they have a host of other reasons.
A hacktivist generally doesn't have significant resources,
they're not looking for financial gain either.
They're really looking to make a political statement.
And a competitor really isn't as much
looking for financial gain.
They may be looking for intellectual property,
or they may be looking to knock
their competitor site offline.
So, I like organized crime syndicate.
Do you agree?
Let's check.
And, that is correct.
Question two, the time, effort, and resources needed
for an attacker to successfully achieve their objective.
How do we describe that?
Is that their motivation, work factor,
resiliency, or investment?
This is a term we've used a couple of times already
in other lessons, and then we used it again in this lesson.
The time, effort, and resources needed
for an attacker to successfully achieve their objective.
Motivation, work factor, resiliency, or investment?
Well, I'm gonna choose work factor.
Now, motivation obviously is very important.
That's the reason why they're going to do something.
Resiliency doesn't really apply here.
Investment, they may need to make a financial investment,
but that doesn't really apply to the question.
Work factor is the time, the effort,
and the resources needed
for an attacker to successfully achieve their objective.
Agree?
Let's check.
And, that is correct.
Question three, this threat actor defaced a website
to make a stand against climate polluters.
Would this be a hacktivist, a nation state,
a hacker, or a cyber criminal?
So, here's the situation.
We have a threat actor that defaced a website
to make a stand against climate polluters.
Who's the most likely threat actor in this case?
The hacktivist, the nation state,
the hacker, or the criminal?
Make that choice.
Well, I'm gonna choose hacktivist, right?
Because a hacktivist is generally trying
to make a political statement.
And we know that the two primary means or methods
that hacktivists use are defacement of a website
and denial of service attacks.
Nation states generally, you know,
are gonna wanna be very stealthy,
and they're not looking to make a stand
against climate polluters.
A hacker's usually looking for financial gain.
A cyber criminal also, or notoriety,
a cyber criminal also looking for financial gain
really isn't looking just to deface a website.
So, I'm going with activist.
You like it?
Let's check.
And, that's correct.
Question four, the early stage of this type of attack
often involves the use of automated programs or bots
that scan networks or systems
for any weakness or easy targets.
Would this be the early stage of a targeted attack,
the early stage of an opportunistic attack,
the early stage of a zero-day attack,
or the early stage of an amplification attack?
So what's happening here, right,
in this early stage, we're using automated programs
or bots to scan the networks or the systems.
What are we looking for?
Weaknesses or an easy target?
So tell me, which type of attack
is this describing the early, early stages?
Well, I'm gonna choose opportunistic, right?
Because in an opportunistic attack,
the attacker isn't sure who their victim is.
What they're first looking for is that easy mark,
that easy target, those vulnerabilities.
That would be an opportunistic.
Targeted, they know exactly who they're going after.
Zero-day, not relevant to this discussion right now,
nor is amplification.
So, I'm gonna go with opportunistic.
Agree?
And, it is correct.
And our last question, question five,
see if we can get 'em all right.
Available sources of this type of threat intelligence
includes news articles, social media platforms,
websites, public records, government documents,
academic research, and online forums.
Is it subscription feeds, covert intelligence,
OSINT, which is open-source intelligence, or the Dark Web?
So, which of these types of threat intelligence
could include news articles, published news articles,
what you see in social media,
what you can get from a website, public records,
government documents, which are also public records,
academic research, which is generally published,
and online forums, right?
So these are all things that are out in the public sphere.
Subscription feeds, covert intelligence,
OSINT, or Dark Web?
Well, I'm gonna choose OSINT,
which is open-source intelligence,
which really refers to publicly available
and accessible information that you can use
in an intelligence context.
Do you like it?
Let's check.
And, that is correct.
Congratulations, great job.
You did really well on those five questions.
So, what's up next?
We're gonna go right into Lesson 6
to Explain Common Threat Vectors and Attack Surfaces.
I'll see you there.