Lesson 5: Compare and Contrast Common Threat Actors and Motivations

Threat

A threat is a category of objects, persons, processes, or events that represent a potential danger to an asset.

Vulnerability

A vulnerability is a weakness in a system, process, or person that can be exploited by a threat.

Exploit

An exploit is when a threat actor successfully takes advantage of a vulnerability.

Threat Actor (Agent)

An adversary is an opponent. A threat actor is an adversary with malicious intent.

Targeted Attack

A targeted attack is when a threat actor chooses a target for a specific objective.

- The choice of target is generally influenced by perceived value of outcome.

Opportunistic Attack

An opportunistic attack is when a threat actor takes advantage of a vulnerable target (not previously known to them).

- The choice of target is generally influenced by work factor.

Cyber Threat Actors

Lone Skilled | Unskilled Attacker
Hacktivist
Organized Crime (cyber-criminals)
Nation-State
Insiders | Shadow IT
Competitors

Script Kiddies

• Bragging rights, notoriety.
  - Low level of sophistication

Hackers

• Financial gain, notoriety
  - Generally talented

Hacktivist

• Political statement
  - Generally talented
  - Funding variable

Cyber-criminal

• Financial gain
  - Well-organized
  - Sophisticated
  - Well-funded

Nation-States

• Surveillance, espionage, disruption, war
  - Well-organized
  - Sophisticated
  - Well-funded
  - Stealthy
  - Luxury of time

Insiders

• Grievance, revenge perceived morality, duress, blackmail
  - Variable level of sophistication and funding

Shadow IT

• Accomplish a task (no malice), circumvent controls

Competitors

• Espionage, IP theft, service disruption, reputation damage
  - Sophisticated
  - Well-funded

Non-adversarial Threats

Natural
Operational
Human

Natural (Threats)

• Natural occurrences e.g., earthquakes, storms and floods.
  - Environmental events e.g., pollution and sea rise.
  - Public health emergencies e.g., pandemic.

Operational (Threats)

• Loss of services e.g., electricity, HVAC.
  - Technical issues e.g., equipment or communications failure.

Human (Threats)

• Accidents
  - Civil disturbances
  - Work stoppages

Threat Modeling

Threat modeling is a structured process by which potential threats and threat actors can be identified, enumerated, and prioritized.

- Motivation, talent, work factor, patience, evasion capabilities, and sometimes luck, all contribute to a successful attack.
- Work factor is the time, effort, and resources necessary for the attacker to successfully achieve their objective.

Threat Modeling Approaches

Asset-centric
Architecture-centric
Attacker-centric

Asset-centric

• What/Why: Identifies valued assets and motivation
  - How: Identifies system design component strength and weaknesses.

Architecture-centric

• Who: Identifies adversaries.

Attacker-centric

• Who: Identifies adversaries.

Threat Intelligence

Threat intelligence is evidence-based knowledge about emerging threats that can be used to inform control decisions.

- Useful threat intelligence is aggregated, analyzed, assessed, and actionable.
- Aggregated from reliable sources and cross-correlated for accuracy.
- Analyzed by trained specialists.
- Assessed for relevancy.
- Actionable. Often includes context, mechanisms, indicators, implications and response / remediation advice.

Threat Intelligence Sources

Technology Vendors
Cybersecurity Companies
Journalists, Researchers & Thought Leaders
Government Agencies

Technology Vendors

Subscription and/or public feeds provided by vendors such as Microsoft, Cisco, or Apple.

Cybersecurity Companies

Subscription and/or public feeds provided by cybersecurity vendors such as TylerDetect, AlienVault, FireEye, RSA, and Secureworks.

Journalists, Researchers & Thought Leaders

Bruce Schneier, Jeremiah Grossman, Brian Krebs, Mark Russinovich, Kim Zetter, Nicole Perlroth, Andy Greenberg, Ellen Nakashima, etc.

Government Agencies

Data provided by agencies such as NIST, FBI, US-CERT, NVD, MITRE and the Cybersecurity & Infrastructure Agency.

Open-Source Intelligence (OSINT)

Open-Source Intelligence (OSINT) is a term used to refer to the data collected from publicly available sources to be used in an intelligence context.

- OSINT Framework a structured collection of OSINT tools.
- OSINT Framework is organized by topics and goals.
- It presents in a tree-form that allows you to browse different OSINT tools filtered by categories.
- FMI: http://osintframework.com/