1.5 Threat actors, vectors and intelligence sources

Question 1

What is a threat

Answer 1

It refers to any possible malicious attack that seeks to unlawfully access data, disrupt digital operations or damage information

Question 2

What is an APT?

Answer 2

Adavanced Persistent Threat: hacker uses continuous, clandestine, and sophisticated hacking techniques to gain access to a system and remain inside for a prolonged period of time

Question 3

Who are the threat actors?

Answer 3

• Insiders: someone within the organization that already have access to the network (eg an employee)
• Nation States: government so they their attacks are highly sophisticated (important ressources)
• Hackivist: hacker with purpose (social change/political), their attacks can be very sophisticated and targeted
• Script kiddies: run pre-made script without any knowledge, their attacks are not very sophisticated and they usually just trying ti gain access
• Organized crime: professional criminals (motivated by money), very sophisticated attacks due to important ressources
• Hackers: experts w/ technology, can be ethical, malicious or semi -authorized hackers
• Shadow IT: the use of information technology systems, devices, software, applications, and services without explicit IT department approval
• Competitors: different motivation (DoS, espionage, harm reputation), high level of sophistication

Question 4

What is attack vectors?

Answer 4

Method that the attacker would use to gain access or infect the target. It takes a lot of work to find a vulnerability and IT security professional spend their career watching these vectors (patch etc)

Question 5

What are the different attack vectors?

Answer 5

• Direct access: physical access to a system (data center, attach a keylogger to collect credentials, unplug power cable etc)
• Wireless: default login credentials used, rogue access point, evil twin
• Email: phishing attacks, social engineering attack
• Supply Chain: gain access to a network using a vendor
• Social media: gather information on someone using social media
• Removable media: use of infected USB for malware, keylogger, data exfiltration
• Cloud: security misconfiguration, bruteforce attack

Question 6

What is threat intelligence?

Answer 6

Evidence-based information about cyber attacks that cyber security experts organize and analyze. This information may include: Mechanisms of an attack. A good source can be OSINT (publicly available info), vulnerability data base (CVE), NIST etc.

Question 7

What are the different type of threat intelligence?

Answer 7

• Strategic
• Tactical: understanding the tactics, techniques and procedureused by the hackers
• Technical
• Operational

Question 8

What is threat research ?

Answer 8

A group of cybersecurity experts dedicated to proactively seeking out potential risks and delivering related insights to their broader security team to take action on.