Threat Actor Attributes.
In the world of cybersecurity understanding the attributes
of threat actors is as crucial
as understanding their motivations.
These attributes provide valuable insights
into their procedures.
In this lesson, we will discuss the different attributes
of threat actors, including their origin being internal
versus external, resources and funding,
and their level of sophistication and capability.
By understanding these attributes
and the threat actor's motivations,
we can gain valuable insights
into their attack styles and the amount of danger
that they pose to our organizations.
First, we have to compare the two most basic attributes
of a threat actor.
Are they an internal threat actor
or an external threat actor?
This classification as either an internal or external
threat actor is based on the threat actor's relationship
to the targeted organization.
Internal threat actors are individuals or entities
within an organization who pose a threat to its security.
These internal threat actors could be angry employees,
contractors, or business associates
who have legitimate access to the organization's systems
and data but are using it unauthorized way.
Internal threat actors can cause significant damage
due to their intimate knowledge
of the organization's infrastructure
and its potential vulnerabilities,
and their actions may be motivated
by various factors including revenge, financial gain,
or coercion by external entities.
For example, if you worked for the Coca-Cola company
and decided to walk into your office today,
plug in an external hard drive,
downloaded the proprietary formula for Coca-Cola,
and then drive over to Pepsi's headquarters
and handed them that drive,
you would be considered an internal threat actor
because you used your legitimate access at Coca-Cola
to steal data from their network
and give it to their biggest competitor, Pepsi.
External threat actors, on the other hand,
are individuals or groups outside an organization
who attempt to breach its cybersecurity defenses.
These external threat actors could be cyber criminals,
hacktivists, competitors, or state-sponsored actors.
External threat actors typically do not have authorized
access to the organization systems,
and must therefore employ various techniques
such as using malware or social engineering techniques
to gain unauthorized access.
Second, we have to look at the resources and funding
available to a specific threat actor
when we are categorizing them.
The resources and funding available to a threat actor
can significantly influence their activities,
including the scale, frequency, and sophistication
of their attacks.
Resources and funding refers to the tools, skills,
and personnel at the disposal of a given threat actor.
For example, a hacker working by themselves
might only have their personal computer
and their individual skills available to them.
But a nation-state actor might have access
to some extremely advanced hacking tools,
a team of skilled operatives, significant computing power,
and a huge budget to support their hacking operations.
Third, we need to consider the level of sophistication
capability of the specific threat actor.
The level of sophistication or capability of a threat actor
refers to their technical skill, the complexity of the tools
and techniques they use, and their ability
to evade detection and countermeasures.
Usually we rate threat actors on a scale from low to high.
Threat actors with a low level
of sophistication capability typically use widely
available tools and techniques such as common malware
or phishing attacks.
In the world of cybersecurity we usually classify
the lowest skilled threat actors as Script Kiddies.
A Script Kiddie is an individual with limited
technical knowledge who uses pre-made software
or scripts to exploit computer systems and networks
often without understanding the underlying principles.
On the other side of the scale
we have threat actors with high levels of sophistication
and capabilities who possess advanced technical skills
and use sophisticated tools and techniques,
including custom developed malware,
zero day exploits against vulnerabilities,
and their ability to employ advanced evasion techniques.
High level threat actors, such as nation-state actors,
groups, and advanced persistent threats
or APT groups can penetrate even the most
well defended networks, maintain a presence
for extended periods of time without detection
when provided with enough time and resources.
So remember, threat actors are classified
based on their attributes,
including whether they are internal or external
threat actors, how many resources and how much funding
they have available for their use,
and their level of sophistication and capabilities.
By understanding these attributes
we can better dissipate a threat actor's actions,
develop effective defenses against their attacks,
and protect our enterprise networks against their attacks.