Chapter 2

Question 1

Internal vs External

Classifying Cybersecurity Threats

Answer 1

Threats, risks, or controls, which can be categorized as either internal vs external.

Internal:
-Malicious insider stealing data.
-poor internal security practices or non-compliance
-Threats rely on having access to internal
External:
-Outside Hackers
-Often more straightforward and easier to detect
-External actors do not inherently have acess, they must bypass defenses.

Question 2

Levels of Sophistication/Capabililty

“Classifying Cybersecurity Threats”

Answer 2

The degree of expertise, resources, and technology employed by threat actors or defensive measures.
* noob to pro hackers
* Script Kiddies, Hacktivists, or criminal groups, nation states, or advanced persistent threats.

Question 3

Resources/Funding

“Classifying Cybersecurity Threats”

Answer 3

The level of financial support, personnel, and tools available to threat actors, or defenders, influencing their ability to execute attacks or implement security measures.

Question 4

Intent/Motivation

“Classifying Cybersecurity Threats”

Answer 4

The driving purpose or objective behind a cybersecurity attack, ranging from financial gain to political agendas, personal grudges, or intellectual property.

Question 5

Script Kiddie

“Threat Actors”

Answer 5

An inexperienced hacker who uses pre-made tools, scripts, or exploits created by others to carry out attacks without a deep understanding of how they work.

Question 6

Organized Crime

“Threat Actors”

Answer 6

Appears in any case where there is money to be made.

Question 6

Hacktivists

“Threat Actors”

Answer 6

Individuals or groups who use hacking techniques to promote a political, social, or ideological cause.

Question 7

Nation-State Attackers

“Threat Actors”

Answer 7

Attacks by nation-state actors hacking into foreign governments or corporations.

Question 8

Advanced Persistent Threats (APTs)

Answer 8

Cybersecurity adversary characterized by a sophisticated series of related attacks taking place over extended period of time.

• APT29 (“Cozy Bear”)

Question 9

Zero-Day Attacks

Answer 9

An attack on a system that exploits vulnerabilites that are unknown to others including the vendor.
-Unpacthed Vulnerabilities

Question 10

Attacker Motivations

Answer 10

1. Data Exfiltration
2. Espionage
3. Service Distribution
4. Blackmail
5. Financial Gain
6. Philosophical/Political Beliefs
7. Ethical attacks
8. Revenge
9. Distruption/Chaos
10. War

Question 11

Attack Surface

Answer 11

A system application, or service, that contains a vulnerability that can get exploit.

Question 12

Threat Vector

Answer 12

The means that threat actors use to obtain access.

Question 13

Threat Intelligence

Answer 13

Gathering and analyzing cyber threat data to predict, detect, and counter attacks. Examples: threat feeds, attack pattern analysis, adversary profiling.

Question 14

Predictive Analysis

Answer 14

The use of data to attempt to predict events, used in security context to identify potential compromises and attacks.

Question 15

Vulnerability Databases

Answer 15

A data base of vulnerabilities, including information like the severity, fixes, and other information useful for both attackers and defenders.

Question 16

Indicators of Compromise (IoCs)

Answer 16

The telltale signs that an attack has taken place and may include file signatures, log patterns, and other evidence left behind by attackers.

Question 17

File and Code Repositories

Answer 17

Platforms, or systems, used for storing, managing, and sharing files or code. IOCs may be found in file and code repositories that offer intelligence information.

Question 18

Open Source Threat Intelligence

Answer 18

Threat intelligence that is acquired from publicly available sources.

Question 19

Closed-Source Intelligence

Answer 19

Intelligence information, typically from a commercial vendor, that is provided only to specific groups.

Question 20

Structured Threat Information Expression (Stix)

“XML Language”

Answer 20

A language that identifies things like attack patterns, identities, malware, threat actors, and tools.

Question 21

Trusted Automated Exchange of Intelligence Information (TAXII)

Answer 21

Intended to allow cyberthreat information to be communicated at the application layer via HTTPS.
-Designed to support STIX data exchange.

Question 22

Information Sharing and Analysis Centers (ISACs)

Answer 22

Helps Infrastructure owners and operators share threat information and provide tools and assistance to their members.

Question 23

Tactics, Techniques, and Procedures (TTPs)

Answer 23

Describes the behaviours and methods used by threat actors during an attack.