Threat Actors Flashcards
What are all of the Threat Actor Motivations?
Data Exfiltration
Financial Gain
Blackmail
Service Disruption
Philosophical or Policitial Beliefs
Ethical Reasons
Revenge
Disruption or Chaos
Espionage
War
What is an Unskilled Attacker?
Someone who lacks the technical knowledge to develop their own hacking tools or exploits. Less likely to be motivated by financial gain or political ideologies
What is a Hacktivist?
Individuals or groups that use their technical skills to promote a cause or drive social change instead of for personal gain. Primarily motivated by their beliefs rather than trying to achieve financial gain.
What is Organized Crime?
Sophisticated and well-structured entities that leverage resources and technical skills for illicit gain.
What are Nation-State Actors?
Groups that are sponsored by a government to conduct cyber operations against other nations, organizations, or individuals. AKA (Advanced Persistent Threat) because of their long-term persistence and stealth.
What are Insider Threats?
Cybersecurity threats that originate from within the organization. Varying levels of sophistication and damage.
What is Shadow IT?
The use of information technology systems, devices, software, applications, and services without explicit organizational approval. Use of personal devices for work purposes, installation of unapproved software, etc.
What is a Threat Vector?
The means or pathway by which an attacker can gain unauthorized access to a computer or network to deliver a malicious payload or carry out an unwanted action.
What is an Attack Surface?
Encompasses all of the various points where an unauthorized user can try to enter or extract data from an environment.
What are the types of Threat Vectors?
Messaging (emails, SMS, IM)
Images
Files
Voice calls
Removable Devices
Unsecured Networks
What are TTPs?
Tactics, Techniques, and Procedures - Specific methods and patterns of activities or behaviours associated with a particular threat actor.
What is a HoneyPot?
Designed to mislead, confuse, and divert attackers from critical assets while simultaneously detecting and neutralizing threats.
What is a HoneyNet?
Network of Honeypots to create a more complex system designed to mimic an entire network of systems, including servers, routers, and switches.
What is a HoneyToken?
A piece of data or a resource that has no legitimate value or use but it monitored for access or use. Useful for detecting insider threats.
What are Disruption Technologies examples?
Bogus DNS - Fake DNS entries introduced into a system’s DNS server
Decoy Directories - Fake folders and files placed within a system’s storage
Dynamic Page Generation - Used in websites to prevent ever-changing content to web crawlers to confuse and slow down the threat actor
Port Triggering - Security mechanism where specific services or ports on a network device remain closed until a specific outbound traffic pattern is detected
Fake Telemetry Data - The system can respond to an attacker’s network scan attempt by sending out fake telemetry or network data
