1
00:00:00,000 --> 00:00:00,833
In this lesson,

2
00:00:00,833 --> 00:00:01,740
we are going to discuss

3
00:00:01,740 --> 00:00:04,140
the different threat actor motivations.

4
00:00:04,140 --> 00:00:05,520
In the world of cybersecurity,

5
00:00:05,520 --> 00:00:08,070
there is always an ongoing battle between the good folks

6
00:00:08,070 --> 00:00:09,240
and the bad folks.

7
00:00:09,240 --> 00:00:10,920
And in order to defend ourselves better

8
00:00:10,920 --> 00:00:12,060
against those bad folks

9
00:00:12,060 --> 00:00:14,250
or threat actors, as we like to call them,

10
00:00:14,250 --> 00:00:17,130
we need to understand the motivations behind their attacks.

11
00:00:17,130 --> 00:00:18,780
By understanding and acknowledging

12
00:00:18,780 --> 00:00:20,880
what drives these individuals or groups,

13
00:00:20,880 --> 00:00:22,950
we can better calculate their moves,

14
00:00:22,950 --> 00:00:24,900
develop effective protective measures,

15
00:00:24,900 --> 00:00:27,933
and ultimately better protect our enterprise networks.

16
00:00:28,770 --> 00:00:30,960
It's important to remember that there is a difference

17
00:00:30,960 --> 00:00:32,700
between the intent behind an attack

18
00:00:32,700 --> 00:00:35,400
and the motivation that fuels that attack.

19
00:00:35,400 --> 00:00:38,580
The threat actor's intent refers to the specific objective

20
00:00:38,580 --> 00:00:40,860
or goal that a threat actor is aiming to achieve

21
00:00:40,860 --> 00:00:41,970
through their attack.

22
00:00:41,970 --> 00:00:43,770
Their motivation, on the other hand,

23
00:00:43,770 --> 00:00:45,570
is really their underlying reasons

24
00:00:45,570 --> 00:00:48,030
or driving forces that pushes a threat actor

25
00:00:48,030 --> 00:00:49,890
to carry out the attack.

26
00:00:49,890 --> 00:00:52,950
So in this lesson, we'll consider the different motivations

27
00:00:52,950 --> 00:00:54,330
behind threat actors,

28
00:00:54,330 --> 00:00:57,600
including data exfiltration, blackmail, espionage,

29
00:00:57,600 --> 00:00:59,760
service disruption, financial gain,

30
00:00:59,760 --> 00:01:01,860
philosophical or political beliefs,

31
00:01:01,860 --> 00:01:05,910
ethical reasons, revenge, disruption or chaos, and war.

32
00:01:05,910 --> 00:01:07,950
First, we have data exfiltration.

33
00:01:07,950 --> 00:01:10,530
Data exfiltration refers to the unauthorized transfer

34
00:01:10,530 --> 00:01:12,570
of data from a computer.

35
00:01:12,570 --> 00:01:14,580
For example, if an attacker is able to log

36
00:01:14,580 --> 00:01:16,770
into one of your organization's computers

37
00:01:16,770 --> 00:01:18,990
and steal your client contact information,

38
00:01:18,990 --> 00:01:21,480
this means that they have successfully exfiltrated data

39
00:01:21,480 --> 00:01:23,070
from your organization.

40
00:01:23,070 --> 00:01:24,810
Threat actors motivated by this

41
00:01:24,810 --> 00:01:27,540
want to access your organization's sensitive information

42
00:01:27,540 --> 00:01:30,090
such as IP or intellectual property,

43
00:01:30,090 --> 00:01:33,840
personal identifiable information or PII, or trade secrets.

44
00:01:33,840 --> 00:01:36,450
This stolen data can be used for various purposes

45
00:01:36,450 --> 00:01:38,280
including selling it on the dark web,

46
00:01:38,280 --> 00:01:39,780
using it for identity theft,

47
00:01:39,780 --> 00:01:42,240
or leveraging it for a competitive advantage,

48
00:01:42,240 --> 00:01:43,560
which is why data exfiltration

49
00:01:43,560 --> 00:01:44,880
is one of the biggest motivations

50
00:01:44,880 --> 00:01:47,340
for many of the different threat actors out there.

51
00:01:47,340 --> 00:01:49,200
Second, we have financial gain.

52
00:01:49,200 --> 00:01:51,270
Financial gain is one of the most common motivations

53
00:01:51,270 --> 00:01:52,320
for cyber criminals.

54
00:01:52,320 --> 00:01:53,370
At the end of the day,

55
00:01:53,370 --> 00:01:55,410
what is something that all criminals like to do?

56
00:01:55,410 --> 00:01:56,243
That's right.

57
00:01:56,243 --> 00:01:58,680
Steal something and gain money from that crime,

58
00:01:58,680 --> 00:02:00,810
and cyber criminals are no different.

59
00:02:00,810 --> 00:02:02,820
Achieving financial gain as a criminal

60
00:02:02,820 --> 00:02:04,830
can be achieved through various means,

61
00:02:04,830 --> 00:02:06,240
such as ransomware attacks

62
00:02:06,240 --> 00:02:08,520
where a threat actor encrypts a victim's data

63
00:02:08,520 --> 00:02:09,930
and demands for a ransom,

64
00:02:09,930 --> 00:02:11,730
or through banking Trojans that allow them

65
00:02:11,730 --> 00:02:13,080
to steal financial information

66
00:02:13,080 --> 00:02:14,970
in order to gain unauthorized access

67
00:02:14,970 --> 00:02:17,310
into the victim's bank accounts.

68
00:02:17,310 --> 00:02:19,080
Third, we have blackmail.

69
00:02:19,080 --> 00:02:20,550
Blackmail is another motivation

70
00:02:20,550 --> 00:02:22,260
that drives certain threat actors.

71
00:02:22,260 --> 00:02:24,390
In these cases, the attacker obtains sensitive

72
00:02:24,390 --> 00:02:25,950
or compromising information

73
00:02:25,950 --> 00:02:28,170
about an individual or an organization

74
00:02:28,170 --> 00:02:30,690
and threatens to release that information to the public

75
00:02:30,690 --> 00:02:32,970
unless certain demands are met.

76
00:02:32,970 --> 00:02:35,550
These demands often involve a financial transaction,

77
00:02:35,550 --> 00:02:36,900
typically requested in the form

78
00:02:36,900 --> 00:02:40,080
of untraceable cryptocurrencies like Bitcoin.

79
00:02:40,080 --> 00:02:42,960
The threat of reputational damage, legal repercussions,

80
00:02:42,960 --> 00:02:45,390
or financial loss can be a strong motivator

81
00:02:45,390 --> 00:02:47,730
to convince victims that they should comply

82
00:02:47,730 --> 00:02:49,680
with the blackmailer's demands.

83
00:02:49,680 --> 00:02:52,200
Cyber blackmail can take many forms,

84
00:02:52,200 --> 00:02:55,620
including ransomware, doxxing, or even sextortion

85
00:02:55,620 --> 00:02:58,080
where a person's own lewd photos are stolen

86
00:02:58,080 --> 00:02:59,610
and the attacker demands a payment

87
00:02:59,610 --> 00:03:01,170
or else they will publicly release

88
00:03:01,170 --> 00:03:02,703
the victim's photos online.

89
00:03:03,690 --> 00:03:05,820
Fourth, we have service disruption.

90
00:03:05,820 --> 00:03:08,130
Some threat actors aim to disrupt the services

91
00:03:08,130 --> 00:03:09,900
of various organizations

92
00:03:09,900 --> 00:03:12,330
either to cause chaos, make a political statement,

93
00:03:12,330 --> 00:03:13,830
or to demand a ransom.

94
00:03:13,830 --> 00:03:15,450
This is often achieved by conducting

95
00:03:15,450 --> 00:03:17,490
a distributed denial of service attack

96
00:03:17,490 --> 00:03:20,340
to overwhelm a network, service, or server

97
00:03:20,340 --> 00:03:22,020
with excessive amounts of traffic

98
00:03:22,020 --> 00:03:24,780
so that becomes unavailable to its normal users.

99
00:03:24,780 --> 00:03:27,630
These service disruptions can lead to significant financial

100
00:03:27,630 --> 00:03:30,690
and reputational damages for the affected organizations.

101
00:03:30,690 --> 00:03:32,100
For example, GitHub,

102
00:03:32,100 --> 00:03:34,470
a popular website used by software developers,

103
00:03:34,470 --> 00:03:37,500
was the victim of a large DDoS attack in 2018

104
00:03:37,500 --> 00:03:39,150
that lasted for about 20 minutes,

105
00:03:39,150 --> 00:03:41,520
and during the time, millions of GitHub users

106
00:03:41,520 --> 00:03:43,230
were unable to access the site

107
00:03:43,230 --> 00:03:44,730
since their servers were being flooded

108
00:03:44,730 --> 00:03:47,790
with excessive traffic from the DDoS attack.

109
00:03:47,790 --> 00:03:50,730
Fifth, we have philosophical or political beliefs.

110
00:03:50,730 --> 00:03:53,250
Attacks that are conducted due to the philosophical

111
00:03:53,250 --> 00:03:55,020
or political beliefs of the attackers

112
00:03:55,020 --> 00:03:56,490
is known as hacktivism.

113
00:03:56,490 --> 00:03:57,810
And this is a common motivation

114
00:03:57,810 --> 00:04:01,080
for a specific type of threat actor known as a hacktivist.

115
00:04:01,080 --> 00:04:03,210
These individuals or groups use hacking

116
00:04:03,210 --> 00:04:06,030
to promote a political agenda, social change,

117
00:04:06,030 --> 00:04:09,600
or to protest against organization they perceive as ethical.

118
00:04:09,600 --> 00:04:10,920
Their actions can range

119
00:04:10,920 --> 00:04:13,650
from website defacement to data leaks.

120
00:04:13,650 --> 00:04:16,500
This type of hacktivism usually targets different types

121
00:04:16,500 --> 00:04:18,480
of organizations and groups,

122
00:04:18,480 --> 00:04:21,089
including those in the political, financial,

123
00:04:21,089 --> 00:04:22,890
and media industries.

124
00:04:22,890 --> 00:04:25,410
Six, we have ethical reasons.

125
00:04:25,410 --> 00:04:27,630
Contrary to malicious threat actors,

126
00:04:27,630 --> 00:04:30,330
ethical hackers, also known as authorized hackers,

127
00:04:30,330 --> 00:04:33,390
are motivated by a desire to improve security.

128
00:04:33,390 --> 00:04:36,150
These are your pen testers and your bounty hunters.

129
00:04:36,150 --> 00:04:39,240
They mimic the way a malicious threat actor operates

130
00:04:39,240 --> 00:04:42,630
in order to further improve an organization's security.

131
00:04:42,630 --> 00:04:45,630
These ethical hackers and penetration testers

132
00:04:45,630 --> 00:04:47,880
focus on identifying vulnerabilities

133
00:04:47,880 --> 00:04:50,460
in an organization's systems and networks

134
00:04:50,460 --> 00:04:52,050
with the intention of patching

135
00:04:52,050 --> 00:04:54,090
and mitigating those vulnerabilities

136
00:04:54,090 --> 00:04:57,603
to prevent a potential exploit by a malicious threat actor.

137
00:04:58,500 --> 00:05:00,240
Seventh, we have revenge.

138
00:05:00,240 --> 00:05:03,180
Revenge is a powerful motivation for some threat actors.

139
00:05:03,180 --> 00:05:04,980
An employee who is disgruntled

140
00:05:04,980 --> 00:05:07,590
or one who has recently been fired or laid off

141
00:05:07,590 --> 00:05:10,350
might want to harm their current or former employer

142
00:05:10,350 --> 00:05:13,140
by causing a data breach, disrupting services,

143
00:05:13,140 --> 00:05:15,060
or leaking sensitive information.

144
00:05:15,060 --> 00:05:17,760
Similarly, revenge can also be a motivation

145
00:05:17,760 --> 00:05:20,100
for a threat actor that wants to target an entity

146
00:05:20,100 --> 00:05:23,280
that they believe has wronged them in some way.

147
00:05:23,280 --> 00:05:25,590
Eight, we have disruption or chaos.

148
00:05:25,590 --> 00:05:27,090
Some threat actors are motivated

149
00:05:27,090 --> 00:05:29,880
by a desire to create disruption or chaos.

150
00:05:29,880 --> 00:05:32,970
These actors, often refer to as unauthorized hackers,

151
00:05:32,970 --> 00:05:36,090
engage in malicious activities for the thrill of it

152
00:05:36,090 --> 00:05:38,910
to challenge their skills or simply to cause harm.

153
00:05:38,910 --> 00:05:41,880
As Alfred Pennyworth, Batman's infamous butler,

154
00:05:41,880 --> 00:05:43,177
said in "The Dark Knight,"

155
00:05:43,177 --> 00:05:45,780
"Some men just want to watch the world burn."

156
00:05:45,780 --> 00:05:47,190
The actions of a threat actor

157
00:05:47,190 --> 00:05:49,560
who is focused on disruption or chaos

158
00:05:49,560 --> 00:05:51,930
could range from creating and spreading malware

159
00:05:51,930 --> 00:05:53,940
to launching sophisticated cyber attacks

160
00:05:53,940 --> 00:05:57,750
against critical infrastructure in populated city.

161
00:05:57,750 --> 00:05:59,640
Ninth, we have espionage.

162
00:05:59,640 --> 00:06:02,880
Espionage is another common motivation for threat actors,

163
00:06:02,880 --> 00:06:06,060
and this one involves spying on individuals, organizations,

164
00:06:06,060 --> 00:06:09,390
or nations to gather sensitive or classified info.

165
00:06:09,390 --> 00:06:11,100
Cyber espionage is often motivated

166
00:06:11,100 --> 00:06:12,570
by national security interests

167
00:06:12,570 --> 00:06:14,160
when conducted by a nation state,

168
00:06:14,160 --> 00:06:16,260
or gaining competitive business intelligence

169
00:06:16,260 --> 00:06:18,570
when conducted by a rival company,

170
00:06:18,570 --> 00:06:20,250
or to gain political advantage

171
00:06:20,250 --> 00:06:23,520
when being conducted by hacktivists or nation state actors.

172
00:06:23,520 --> 00:06:26,070
Often, you will find espionage activities are conducted

173
00:06:26,070 --> 00:06:28,200
by nation state actors who are seeking

174
00:06:28,200 --> 00:06:31,320
to gain strategic advantages over other nations

175
00:06:31,320 --> 00:06:33,750
that they view as their adversaries.

176
00:06:33,750 --> 00:06:35,820
And 10th, we have war.

177
00:06:35,820 --> 00:06:37,500
In the context of modern warfare,

178
00:06:37,500 --> 00:06:40,560
cyber attacks have increasingly become a tool for nations

179
00:06:40,560 --> 00:06:43,830
to attack each other both on and off the battlefield.

180
00:06:43,830 --> 00:06:45,120
Cyber warfare can be used

181
00:06:45,120 --> 00:06:47,010
to disrupt a country's infrastructure,

182
00:06:47,010 --> 00:06:48,660
compromise its national security,

183
00:06:48,660 --> 00:06:50,730
and to cause economic damage.

184
00:06:50,730 --> 00:06:52,110
Nation state threat actors

185
00:06:52,110 --> 00:06:54,570
are most often found to be the source of attacks

186
00:06:54,570 --> 00:06:57,450
that are motivated by geopolitical objectives.

187
00:06:57,450 --> 00:06:59,430
So remember, in cybersecurity,

188
00:06:59,430 --> 00:07:01,380
it is important to understand the motivations

189
00:07:01,380 --> 00:07:03,570
behind different types of threat actor attacks

190
00:07:03,570 --> 00:07:06,300
to help formulate an effective defense against them.

191
00:07:06,300 --> 00:07:08,670
Threat actors are driven by diverse motivations

192
00:07:08,670 --> 00:07:11,040
that range from those seeking data exfiltration

193
00:07:11,040 --> 00:07:12,270
and financial gain

194
00:07:12,270 --> 00:07:14,880
to those pursuing blackmail, service disruption,

195
00:07:14,880 --> 00:07:18,510
or actions aligned with a philosophical or political belief.

196
00:07:18,510 --> 00:07:20,790
Some hackers are driven by ethical reasons

197
00:07:20,790 --> 00:07:22,590
and help us enhance the security

198
00:07:22,590 --> 00:07:24,480
of our organization's networks

199
00:07:24,480 --> 00:07:26,340
while others may act out of revenge,

200
00:07:26,340 --> 00:07:28,290
a desire for chaos, espionage,

201
00:07:28,290 --> 00:07:30,240
or even trying to use cyber warfare

202
00:07:30,240 --> 00:07:33,300
to achieve their nation's geopolitical objectives.

203
00:07:33,300 --> 00:07:35,520
By properly recognizing the driving forces

204
00:07:35,520 --> 00:07:37,020
behind these threat actors,

205
00:07:37,020 --> 00:07:39,780
we can better predict how they might attack us

206
00:07:39,780 --> 00:07:41,820
and develop protective countermeasures

207
00:07:41,820 --> 00:07:45,573
to prevent a future attack against our organization.