Threat Actors (Section 3)

Question 1

Shadow IT

Answer 1

• IT systems, devices, software, or services managed without explicit organizational approval
• IT-related projects that are managed outside of, and without the knowledge of, the IT department

Question 2

Threat Actors and Attack Surfaces

Answer 2

Message-based / Image-based / File-based / Voice Calls / Removable Devices / Unsecured Networks

Question 3

Deception and Disruption Technologies

Answer 3

Technologies designed to mislead, confuse, and divert attackers from critical assets while simultaneously detecting and neutralizing threats
Like - Honeypots / Honeynets / Honeyfiles / Honeytokens

Question 4

Honeyspots / Honeynets / Honeyfiles / Honeytokens

Answer 4

Honeypots - Decoy systems to attract and deceive attackers
Honeynets - Network of honeypots to create a more complex system that is designed to mimic an entire network of systems - severs / routers / switches
Honeyfiles - Decoy files to detect unauthorized access or data breaches
Honeytokens - Piece of data or a resource that has no legitimate value or use but is monitored for access or use

Question 5

Script Kiddie

Answer 5

• Individual with limited technical knowledge
• use pre-made software or scripts to exploit computer systems and networks

Question 6

Hactivists / Hactivism

Answer 6

Hactivists - Individuals or groups that use their technical skills to promote a cause or drive
social change instead of for personal gain
Hactivism - Activities in which the use of hacking and other cyber techniques is used to
promote or advance a political or social cause

Question 7

Hactivists Motivations

Answer 7

Hacktivists are primarily motivated by their ideological beliefs rather than trying to achieve financial gains

Question 8

Techniques used by Hactivists

Answer 8

Website Defacement / DDoS / Doxing / Leaking of Sensitive Data

Question 9

Doxing

Answer 9

Attempting to overwhelm the victim’s systems or networks so that they cannot be accessed by the organization’s legitimate users

Question 10

Website Defacement

Answer 10

Form of electronic graffiti and is usually treated as an act of vandalism

Question 11

Organized Cybercrime Group

Answer 11

organized crime groups possess a very high level
of technical capability and they often employ advanced hacking techniques and tools
- Custom Malware / Ransomware / Sophisticated Phishing Campaigns

Question 12

Organized Cybercrime group

Answer 12

• Unlike hacktivists or nation state actors, organized cybercrime groups are not typically driven by ideological or political objectives
• These groups may be hired by other entities, including governments, to conduct cyber operations and attacks on their behalf

Question 13

Nation-state Actor

Answer 13

• Groups or individuals that are sponsored by a government to conduct cyber operations against other nations, organizations, or individuals
• Nation-state actors possess advanced technical skills and extensive resources, and they are capable of conducting complex, coordinated cyber operations that employ a variety
  of techniques such as - Use zero-day exploits / creating custom malware / Becoming an advanced persistent threats

Question 14

False Flag Attack

Answer 14

Attack that is orchestrated in such a way that it appears to originate from a different source or group than the actual perpetrators, with the intent to mislead investigators and attribute the attack to someone else

Question 15

Advanced Persistent Threat (APT)

Answer 15

• Term that used to be used synonymously with a nation-state actor because of their long-term persistence and stealth
• A prolonged and targeted cyberattack in which an intruder gains unauthorized access to a network and remains undetected for an extended period while trying to steal data or monitor network activities rather than cause immediate damage
• These advanced persistent threats are often sponsored by a nation-state or its proxies, like organized cybercrime groups

Question 16

How to mitigate threat of an Insider threat?

Answer 16

• Zerot-trust architecture / Employ robust access controls / Conduct regular audits / Provide effective employee security awareness programs

Question 17

Why does Shadow IT exists?

Answer 17

An organization’s security posture is actually set too high or is too complex for business operations to occur without be negatively affected eg. BYOD

Question 18

Threat Vector

Answer 18

Means or pathway by which an attacker can gain unauthorized access to a computer or network to deliver a malicious payload or carry out an unwanted action

Question 19

Attack Surface

Answer 19

Encompasses all the various points where an unauthorized user can try to enter data to or extract data from an environment.
Can be minimized by - Restricting access / Removing unnecessary software / Disabling unused protocols

Question 20

Threat Vector and Attack Surface

Answer 20

Think of threat vector as the “how” of an attack, whereas the attack surface is the “where” of the attack

Question 21

Bluetooth vulnerabilities used

Answer 21

BlueBorne - Set of vulnerabilities in Bluetooth technology that can allow an attacker to take over devices, spread malware, or even establish an on-path attack to intercept
communications without any user interaction
BlueSmack - Type of Denial of Service attack that targets
Bluetooth-enabled devices by sending a specially crafted
Logical Link Control and Adaptation Protocol packet to a
target device

Question 22

Outsmarting Threat Actors

Answer 22

One of the most effective ways to learn from the different threat actors that are attacking your network is to set up and utilize deception and disruption technologies

Question 23

TTPs - Outsmarting Threat Actors

Answer 23

Specific methods and patterns of activities or behaviors associated with a particular threat actor or group of threat actors

Question 24

Disruption technologies and strategies to help secure networks

Answer 24

Bogus DNS entries / Creating decoy directories / Dynamic page generation / Use of port triggering to hide services / Spoofing fake telemetry data /