Threat Actors and Motivations

Profile the attacker before you defend

A bank guards against robbers differently than against embezzlers. Security is the same: the right defenses depend on who is likely to attack and why. The exam gives you a scenario and asks for the actor, or gives the actor and asks for the motive. Learn each one as a profile with three attributes and a motive.

The profiles

Actor               Internal/external   Resources     Sophistication   Typical motive
Nation-state        external            vast          highest          espionage, war, disruption
Organized crime     external            high          high             financial gain
Hacktivist          external            low-moderate  varies           political or philosophical, disruption
Insider threat      internal            has access    varies           revenge, financial gain, or accidental
Unskilled attacker  external            low           low              chaos, notoriety, curiosity
Shadow IT           internal            n/a           n/a              convenience; not malicious

Each one in a sentence

• Nation-state: a government team with a budget measured in years. They write custom malware, exploit zero-days, and stay hidden in a target for months. This is the advanced persistent threat. Targets: other governments, defense contractors, infrastructure, companies with valuable intellectual property.
• Organized crime: professional criminals running a business. Ransomware with help desks, stolen data sold in bulk, fraud at scale. If the scenario ends with a demand for money, this is the actor.
• Hacktivist: attacks to make a statement. Website defacement, leaking documents, denial of service against an organization they oppose. Skill varies from amateur to expert; the motive is the tell.
• Insider threat: an employee, contractor, or partner. They do not need to break in; they are already in. Malicious insiders steal data for a competitor, sabotage systems out of revenge, or sell access. Unintentional insiders click the phishing link or misconfigure the storage bucket. Both count.
• Unskilled attacker: runs tools and scripts written by others without understanding them. Low capability but numerous, and an unpatched system falls to them just the same.
• Shadow IT: the marketing team that set up its own cloud file share because the approved one was slow. Nobody is attacking, but the data is now outside every control: unpatched, unmonitored, unbackedup, and unknown to security.

The three attributes

Questions often describe attributes instead of naming the actor.

• Internal versus external: does the actor already have legitimate access? Only the insider and shadow IT are internal.
• Resources and funding: nation-states and organized crime can sustain long campaigns; hacktivists and unskilled attackers cannot.
• Level of sophistication: custom tooling and zero-days at the top, downloaded scripts at the bottom.

"Well funded and highly sophisticated" narrows to two: nation-state or organized crime. The motive breaks the tie. Espionage or war: nation-state. Money: organized crime.

Motivations

Data exfiltration, espionage, service disruption, blackmail, financial gain, philosophical or political beliefs, ethical (authorized testers), revenge, disruption or chaos, war. Several actors share motives; that is why the attributes matter too.

Worked scenarios

• Malware found on a power utility's control network, dormant for eight months, unique code never seen before: nation-state.
• Files encrypted, a portal offers a discount for paying within 72 hours: organized crime.
• The company home page now displays a manifesto about its environmental record: hacktivist.
• A departing engineer emailed the source code repository to a personal account: insider threat.
• A scan finds an unregistered server running an unpatched database that a department set up: shadow IT.
• Attack traffic matches a freely downloadable tool, unmodified, run against every public address: unskilled attacker.

What to memorize

• Nation-state: funded, patient, espionage. Organized crime: money. Hacktivist: a cause.
• Insider: already inside, malicious or accidental. Unskilled: borrowed tools. Shadow IT: unapproved, not malicious.
• Internal versus external, resources, sophistication.