Threat Actors in Cybersecurity

Definition of Threat Actor

• An entity causing events affecting the security of others.
• Often referred to as malicious actors due to negative impacts.

Importance of Identifying Threat Actors

• Understanding the attacker helps in understanding attack motives and goals.
• Attackers can be internal or external to the organization.

Characterizing Threat Actors

• Resources and Funding:
  • Limited resources indicate less capability for attacks.
  • Extensive resources, like those of governments, enable advanced attacks.
• Level of Sophistication:
  • Ranges from unskilled (script kiddies) to highly skilled individuals.

Motivation of Threat Actors

• Data exfiltration, espionage, service disruption, philosophical/political reasons.
• Motivation varies by attacker type and context.

Types of Threat Actors

1. Nation State

• Often involves entire governments or branches focused on national security.
• Motivations: data exfiltration, philosophical, political, or disruption.
• Resources: Enormous, enabling constant and varied attacks.
• Example: Stuxnet worm by the U.S. and Israel targeting nuclear facilities.

2. Unskilled Attackers

• Run scripts without understanding them.
• Motivated by simple disruption or data theft.
• Limited resources and capabilities.

3. Hacktivists

• Motivated by political/philosophical reasons and disruptions.
• Sophisticated but usually lack significant financial resources.
• Can work externally or infiltrate organizations.

4. Insider Threat

• Internal employees exploiting organizational resources for malicious purposes.
• Motivations: revenge, financial gain.
• Medium sophistication but high knowledge of organizational systems.

5. Organized Crime

• Motivated by financial gain/profit.
• Can have corporate-like structures with roles for hacking, exploit creation, data sales, and support.
• Sophisticated with substantial resources.

6. Shadow IT

• Internal groups bypassing IT policies to create their own infrastructure.
• Limited by budget but can pose security risks due to lack of IT knowledge.

Summary Table

• External Threat Actors: Nation state, unskilled, hacktivist, organized crime.
• Internal Threat Actors: Insider threats, shadow IT.
• Resources and Sophistication:
  • Nation state and organized crime have high resources and sophistication.
  • Unskilled and shadow IT have low resources and sophistication.
• Motivations:
  • Vary from political, revenge, financial gain, and disruption.

Conclusion

• Understanding motivations and characteristics aids in tailoring security measures to prevent access.