2.1 — Threat Actors

Threat Actor

An individual or group responsible for a security event or attack.

Internal Threat Actor

A threat actor operating from inside an organization, often with legitimate access or knowledge of internal systems.

External Threat Actor

A threat actor operating from outside the organization.

Threat Actor Resources and Funding

The money, tools, personnel, and infrastructure available to a threat actor.

Threat Actor Sophistication

The technical skill and capability a threat actor has to develop, modify, and execute attacks.

Threat Actor Motivation

The reason a threat actor conducts an attack, such as money, ideology, espionage, revenge, or disruption.

Nation-State

Government-associated threat actor with extensive funding, resources, and technical sophistication.

Nation-State Motivation

Often espionage, political objectives, disruption, or warfare.

Advanced Persistent Threat APT

A sophisticated and well-resourced threat that can maintain long-term access to a target, often associated with nation-state activity.

Stuxnet

Example of sophisticated malware designed to target nuclear centrifuges.

Unskilled Attacker

Threat actor with limited technical knowledge who commonly uses existing scripts and attack tools.

Unskilled Attacker Limitation

May successfully use existing tools but have difficulty modifying an attack when it fails.

Hacktivist

Threat actor motivated by political or philosophical beliefs rather than primarily by money.

Hacktivist Activities

May perform denial-of-service attacks, website defacement, or leak information to promote a cause.

Insider Threat

Threat originating from someone inside the organization who already has legitimate access or internal knowledge.

Insider Threat Advantage

Already understands internal systems and may have authorized access that can be abused.

Insider Threat Motivation

May include revenge or financial gain.

Organized Crime

Well-funded and sophisticated criminal groups primarily motivated by financial gain.

Organized Crime Motivation

Money and profit.

Shadow IT

Hardware, software, or services used within an organization without approval or control from the IT department.

Shadow IT Risk

Can bypass security reviews, backups, change controls, and other organizational security processes.

Nation-State vs Organized Crime

Nation-states are commonly motivated by government objectives or espionage, while organized crime is primarily motivated by financial gain.

Hacktivist vs Organized Crime

Hacktivists are primarily motivated by ideology, while organized crime is primarily motivated by money.

Insider vs External Threat

An insider already has organizational access or knowledge, while an external attacker begins outside the organization.

Threat Actor vs Threat Vector

Threat actor identifies who performs the attack, while threat vector describes how the attack reaches the target.