1.5 Explain Different Threat Actors, Vectors And Intelligence Sources Flashcards
What is a threat actor for cyber security?
A threat actor is anyone or anything that has a motive and resources to attack another enterprise’s IT infrastructure. A threat actor can be a malicious person or a malicious program.
What is an Advanced persistent threat (APT)?
This is where a threat actor gets long-term control of a compromised system, continually looking for new data to steal.
What is an insider threat?
It is an actor that is apart of an organization. As apart of the targeted organization, these actors have substantial physical access and usually have user accounts that give them access to assets. These insiders are often motivated by revenge or greed.
What is a state actor?
State actors or nation actors refer to government-directed attacks. State actors take advantage of vulnerabilities to acquire intelligence. State actors are easily the best funded and most sophisticated of all the threat actors.
What is a hacktivist?
It is a hacker and an activist. These threat actors have some form of agenda, often political or fueled by a sense of injustice. Think of organizations like anonymous.
What are script kiddies?
Script kiddies are poorly skilled threat actors who take advantage of relatively easy-to-use open-source stacking tools. Their lack of sophistication makes them notoriously easy to stop, most of the time.
What are criminal syndicates?
Criminal syndicates use extra-legal methods to gain access to resources. They are a huge problem today. These groups are sophisticated, are well funded, cause tremendous damage to vulnerability systems worldwide to make money.
What are White hat hackers?
White hat hackers use their skills for good, checking for vulnerabilities and working with the full consent of the target. These are authorized hackers.
What are black hat hackers?
These black hat hackers do not have the consent of the target. They are unauthorized hackers.
What are gray hat hackers?
Gray hat hackers fall somewhere in the middle. They’re rarely malicious, but usually do not have the target’s consent. They are semi authorized.
What is a shadow IT?
Shadow IT describes information technology systems installed without the knowledge or consent of the main IT department. Almost never based on malicious intent. Shadow IT springs up when users need to work around limitations imposed by IT department for purposes of security limitations that hamper their jobs.
What are competitors?
Competitors are outside organizations that try to gain access to the same customers as the targeted company. Competitors, definition in the same business, know precisely the type of secure information they want.
What are the attributes of threat actors?
Internal/external, intent/motivation, resources/funding, level of sophistication/capability.
What are different attack vectors?
It can be done through:
Direct access
Wireless
Supply chain
Removable media
Cloud
What is a Threat Intelligence Source?
Threat Intelligence Sources enable security professionals to research potential threats to their organizations and share threats they discover with their peers. These sources reveal the past and current threats, explore threats by defining characteristics or signature types, and much more.
