Introduction

This chapter covers the first objective in Domain 2.0, Threats, Vulnerabilities, and Mitigations of the CompTIA Security+ exam.

In this chapter, we will identify types of cybercriminals and threat actors, ranging from nation states, advanced persistent threats, organized criminals, hacktivists, and insider threats to the unskilled attacker. We’ll also review common motives of each of these threat actors, including financial gain, political ideology, ethical considerations, and even simple chaos. Through this exploration, you will equip yourself with the knowledge to identify these threats and protect your organization.

This chapter will give you an overview of why companies rely on these controls to keep their environments safe, and ensure you are prepared to successfully answer all exam questions related to these concepts for your certification.

Note

A full breakdown of Exam Objective 2.1 will be provided at the end of the chapter.

Threat Actors

It’s crucial for professionals working in cybersecurity to understand the various threat actors that can pose risks to organizations, governments, and individuals alike. Threat actors are entities or individuals that engage in cyber activities, ranging from benign to malicious. This section covers six distinct types of threat actors: nation states, unskilled attackers, hacktivists, insider threats, organized crime groups, and shadow IT, defined as follows:

• Nation state: Nation state threat actors are perhaps the most formidable adversaries in the realm of cybersecurity. These are government-sponsored entities that engage in cyber operations to further their national interests. Often possessing substantial resources and advanced technical capabilities, nation states can launch sophisticated attacks, such as espionage, data theft, and even sabotage. Their motives can vary widely, from influencing other countries’ elections to gaining political influence...

Attributes of Actors

In the rapidly changing world of cybersecurity, comprehending the attributes of threat actors is essential for devising effective defense strategies. Threat actors, entities, or individuals responsible for cyber threats possess distinct characteristics that play a pivotal role in shaping their intentions, capabilities, and potential impact. This section explores three critical attributes of threat actors: internal/external distinction, resources/funding availability, and level of sophistication/capability. Understanding whether the threat originates from within your organization or outside of it is vital for tailoring defenses and incident response strategies to the specific characteristics of the threat actor.

Threat actors are typically classed as internal or external. An internal attacker launches their attack from inside the company, while an external attacker launches their attack from outside of the company. These classifications are further defined here...

Motivations

Understanding the motivations that drive cyber threat actors is paramount to building effective defense strategies. These motivations span a diverse spectrum, ranging from financial gain to political ideology. This section discusses some of the more common, pervasive motivations behind cyber threats and the methods that they take to achieve their goals:

• Data Exfiltration: One of the most prevalent motivations, revolves around stealing sensitive information. Cybercriminals often target personal and financial data to later sell on the dark web. Organizations are at risk of intellectual property theft, which can have far-reaching economic implications, as well as breaches of customer data that result in tarnished reputations and legal ramifications.
• Espionage: The realm of cyberspace has become a fertile ground for espionage, where nation-states and other entities engage in covert activities to gather intelligence. Espionage-driven motivations involve infiltrating...

Summary

This chapter covered common threat actors, including nation states, unskilled attackers, hacktivists, insider threats, organized crime groups, and shadow IT. It also examined attributes of these actors, such as whether they are internal or external to an organization, their available resources and funding, and their level of sophistication and capability.

Additionally, the chapter delved into the motivations driving these threat actors, which encompassed data exfiltration, espionage, service disruption, blackmail, financial gain, philosophical and political beliefs, ethical considerations, revenge, disruption and chaos creation, and even acts of war. Understanding these elements is crucial for effective cybersecurity and risk mitigation strategies.

The knowledge gained in this chapter will prepare you to answer any questions relating to Exam Objective 2.1 in your CompTIA Security+ certification exam.

The next chapter is Chapter 6, Explain common threat vectors and...

Exam Objectives 2.1

Compare and contrast common threat actors and motivations.

• Threat actors:
  • Nation state: Government-backed cyber operatives
  • Unskilled attacker: Novice with limited hacking skills
  • Hacktivist: Activist hacker with political or social agenda
  • Insider threat: Trusted insider posing cybersecurity risks
  • Organized crime: Criminal group seeking financial gain via cybercrime
  • Shadow IT: Unauthorized, unregulated tech use within an organization
• Attributes of actors:
  • Internal/external: Originating from within or outside an entity
  • Resources/funding: Availability of financial and technological support
  • Sophistication/capability: Level of expertise and technological proficiency
• Motivations:
  • Data exfiltration: Stealing sensitive data for illicit purposes
  • Espionage: Gathering information for intelligence or competitive advantage
  • Service disruption: Disrupting systems or services intentionally
  • Blackmail: Extortion using compromising information
  • Financial gain: Profiting from cybercriminal...

Chapter Review Questions

The following questions are designed to check that you have understood the information in the chapter. For a realistic practice exam, please check the practice resources in our exclusive online study tools (refer to Chapter 29, Accessing the online practice resources for instructions to unlock them). The answers and explanations to these questions can be found via this link.

1. Which threat actor category is most likely to steal a major multinational corporation’s confidential trade secrets for the benefit of a competing company?
   1. A nation-state
   2. Unskilled attacker
   3. A hacktivist
   4. Organized crime
2. A cyber attacker gains access to an organization’s sensitive customer information and threatens to expose it unless a substantial sum of money is paid. What category of cyber threat does this scenario represent? Select the BEST option.
   1. Blackmail
   2. Financial gain
   3. Ransomware attack
   4. Espionage
3. Which of the following attributes of threat actors defines their...