Cybersecurity Lesson 2: Threat Types

Lesson 2: Comparing Threat Types

• This lesson covers different threat actors, their attributes, motivations, and associated attack vectors and surfaces.
• Objectives include comparing and contrasting threat actor attributes and motivations, as well as explaining common threat vectors and attack surfaces.
• A vulnerability, threat, and risk model explains how these factors relate to risk calculation.

Topic 2A: Threat Actors

• Threat actors can be categorized in many ways. Known threats and adversary behaviors differ, as do internal/external threats.
• Internal threats already have authorized access. The attribute of the threat actor, not the attack location, is key.
• Sophistication levels influence tools used. Low-capability actors use readily available tools, while high-capability actors can develop new attacks for political or military assets.

Motivations of Threat Actors

• Threat actors can be motivated by malicious intent (targeted attacks) or opportunism (opportunistic attacks). Accidental/unintentional actions are also possibilities.
• Strategies include service disruption, data exfiltration, and disinformation.
• Motivations include chaotic actions (e.g., vandalism), financial gain (e.g., blackmail, extortion, and fraud), and political motivations (e.g., whistleblowers, campaigns, nation-state actors).

Hackers and Hacktivists

• "Lone Hacker" types include white hats (ethical hackers) and black hats (malicious hackers).
• Categories exist for authorized vs. non-authorized attackers.
• Unskilled attackers may use "script kiddie" tactics.

Nation-State Actors and Advanced Persistent Threats (APTs)

• Nation-state actors, attached to military/secret services, have a high capability level.
• APTs are known for espionage and strategic advantage, with deniability and false flag operations as common methods.

Organized Crime and Competitors

• Organized crime often operates across legal jurisdictions and is motivated by criminal profit.
• They can be well-resourced and funded.
• Cyber espionage and disinformation are common activities; competitors can combine with insider threats.

Internal Threat Actors

• Malicious insiders have authorized access and can cause sabotage, financial loss, or business advantage.
• Unintentional insider threats stem from weak policies/procedures, lack of training, or shadow IT.

Topic 2B: Attack Surface

• Attack surfaces are areas where attackers can discover and exploit vulnerabilities in physical, network, application, and human systems.
• Attack surfaces can span broad organization scopes or be narrowed to a single system.
• High-capability actors can expand attack surfaces by developing novel attack vectors.

Vulnerable Software Vectors

• Vulnerabilities in software (faulty code/design issues or delayed patching) are common attack entry points.
• Unsupported systems and applications often lack updates/security patches.
• Client-based vs. agent-based vulnerability scanners have different functionalities.

Network Vectors

• Exploits can target remote or local network systems.
• Lack of confidentiality, integrity, and availability can create weaknesses.
• Physical (wired) and wireless network access, cloud services, Bluetooth, default credentials, and open ports are common vulnerabilities in networks.

Lure-based Vectors

• Lure-based vectors entice victims into opening malicious files (executable files, Trojan horses), clicking links in documents (macro/scripting files), or opening image files.

Message-based Vectors

• Attack vectors such as email, SMS, IM, web/social media, and voice calls can all be used to spread malicious content.

Supply Chain Attack Surface

• Supply chain attack surfaces encompass the entire process of designing, manufacturing, and distributing goods and services.
• Procurement management, suppliers, vendors, and business partners impact the overall complexity of supply chains.
• Effective defense strategies must account for the potential for threat actors to leverage supply chain access points

Review Activity: Attack Surface (Summary)

• Attack vectors and attack surfaces must be considered for all these topics

Review Activity: Threat Actors (Summary)

• Identifying different threat actors, their attributes, and motivations is essential to develop an effective security strategy.

Topic 2C: Social Engineering

• "Hacking the human" is a core social engineering principle.
• Purposes of social engineering include reconnaissance, eliciting information, and gaining unauthorized access.

Human Vectors

• Social engineering techniques can be used to persuade targets to take actions, such as opening malicious files.
• Tactics include contact with help desks and gaining access to premises and installing monitoring devices.

Impersonation and Pretexting

• Impersonation aims to pretend to be someone else, employing persuasion techniques.
• Pretexting exploits situations where identity verification is not robust or to gain additional information.

Phishing and Pharming

• Phishing techniques trick users into entering credentials on fraudulent websites.
• Phishing takes advantage of trusted communications and websites.
• Vishing and SMiShing use voice calls and text messages to conduct phishing schemes respectively.
• Pharming redirects users to fake websites via DNS spoofing.

Typosquatting

• Typosquatting makes phishing messages more convincing by creating look-alike or similar websites to trusted websites.
• This is frequently done through email spoofing practices, including from field confusion tactics.

Business Email Compromise

• Targets are often specific individuals within a company.
• Posing as colleagues, business partners, or vendors creates trust and enables the threat actor to gain entry.
• Brand impersonation, disinformation, and watering hole attacks leverage fake websites and correspondence.

Review Activity: Social Engineering (Summary)

• Social engineering techniques are used to exploit human vulnerabilities, focusing on impersonation, pretexting, phishing, and pharming to manipulate users into divulging information or executing malicious tasks.
• These techniques may include typosquatting and business email compromise.

Lab Activity (Multiple)

• Lab activities are designed for practical application, such as finding open service ports and using tools to demonstrate social engineering techniques.