1.1 AP Cybersecurity

Reconnaissance

The planning phase. Researching the target (e.g., scanning networks, looking up employees on LinkedIn).

Initial Access

Getting a foothold. The first breach (e.g., phishing email, exploiting a vulnerability, weak password).

Persistence

Staying in. Creating a backdoor (e.g., installing malware that runs every time the computer starts).

Lateral Movement

Exploring the network. Moving from one system to another to find valuable data (e.g., accessing the HR server from a marketing computer).

Taking Action

The end goal. Stealing data, encrypting files for ransom, destroying systems. Also called Impact.

Evading Detection

Covering their tracks. Deleting logs, hiding files, using encryption to avoid being found.

Authority

Impersonating someone in charge (e.g., "This is the IT Director, I need your password now.").

Intimidation

Using threats or fear (e.g., "If you don't pay this fake fine, you will be arrested.").

Consensus/Social Proof

"Everyone else is doing it" (e.g., "All your colleagues have already updated their credentials through this link.").

Familiarity/Liking

Pretending to be a friend or shared connection (e.g., "Hey, it's me from the conference! Click this.").

Scarcity

"Limited time offer!" (e.g., "Act now to claim your exclusive prize before it's gone!").

Urgency

Creating a time-sensitive emergency (e.g., "Your account will be deleted in 5 minutes if you don't verify!").

Script Kiddie

Low skill, uses others' tools. Motivated by notoriety and fun. The "spray-and-pray" attacker.

Hacktivist

Motivated by a political or social cause (e.g., environment, human rights). Goal is to send a message or disrupt for their ideology.

Insider Threat

The attacker is already inside the organization. Motivated by revenge, money, or ideology. Has legitimate access.

Cyberterrorist

Motivated by ideology/politics to cause widespread fear, disruption, or physical harm (e.g., attacking power grids).

Transnational Criminal Organization

Highly organized for financial gain. Focus on ransomware, stealing IP, fraud. Like a digital mafia.

State Adversary

Government-backed, highly skilled, well-funded. Goal is espionage, sabotage, or influencing geopolitics.