Security+ topic 2.2
Threat Actors and Motivations
A threat actor is whoever is behind an attack. Nation-state actors are well funded and patient, often running advanced persistent threats (APTs) for espionage or disruption. Organized crime wants money, often through ransomware. Hacktivists attack to make a political or social point. Insider threats already have access, either by malice or by mistake. Unskilled attackers use tools other people wrote. Shadow IT is employees using unapproved apps or devices, which creates risk without any bad intent. Describe each actor by its attributes: internal or external, resources and funding, and level of sophistication, and ask what motivates it, such as data theft, money, revenge, or disruption.
Threat Actors and Motivations vocabulary
- Nation-state actor: An attacker working for a government, with large resources and long-term goals.
- Advanced persistent threat (APT): A skilled attacker who stays hidden inside a network for a long time.
- Hacktivist: An attacker motivated by a political or social cause.
- Shadow IT: Technology used inside an organization without the IT department's approval.
Exam-style practice questions
Try each one, then open the answer. To save your progress, take this quiz in the interactive course.
1. A group with large funding stays hidden inside a defense contractor's network for two years, quietly copying designs. Which of the following best describes this threat actor?
- (A) An unskilled attacker
- (B) A nation-state actor
- (C) A hacktivist
- (D) Shadow IT
Show answer
(B) A nation-state actor Long-term, well-funded espionage is typical of a nation-state APT.
2. A marketing team signs up for an unapproved cloud file-sharing service to share large files with clients. Which of the following does this represent?
- (A) An insider threat with malicious intent
- (B) Shadow IT
- (C) A watering hole attack
- (D) Organized crime
Show answer
(B) Shadow IT Using technology without IT's approval is shadow IT.
3. Attackers deface a company's website with messages protesting its environmental record. Which of the following is the most likely threat actor?
- (A) A hacktivist
- (B) Organized crime
- (C) A nation-state
- (D) A competitor
Show answer
(A) A hacktivist Attacks to promote a political or social cause are typical of hacktivists.
4. Which of the following threat actors is most likely motivated by financial gain and to use ransomware?
- (A) A hacktivist
- (B) Organized crime
- (C) A whistleblower
- (D) An unintentional insider
Show answer
(B) Organized crime Organized crime groups attack for money, often with ransomware.