Threats & Threat Actors
154 cards · 11 sections
Sections▾
Threat Actors — Introduction
Threat Actor
An individual or entity that poses a security risk and can be responsible for incidents affecting confidentiality, integrity, availability, or privacy. Threat actors range from lone attackers to organized crime groups, nation-state actors, and insiders.
Unskilled Attacker (Script Kiddie)
An individual with limited technical skill who uses readily available tools, downloaded scripts, or pre-built exploits to carry out attacks. Also called a script kiddie and typically characterized by low sophistication and low capability.
Hacktivist
A cyber attacker whose activities are driven by political, social, or environmental ideologies. Goal is to draw attention to a specific cause rather than financial gain.
Organised Crime
Well-structured criminal groups that conduct cyber attacks primarily for financial gain. Common activities include ransomware, identity theft, payment card fraud, and credential theft.
Nation-State Actor
Highly skilled attackers sponsored by governments to conduct cyber espionage, sabotage, or cyber warfare. Nation-state actors typically have the highest levels of sophistication, capability, and resources.
Insider Threat
A security threat that originates from within the organization and involves a person with legitimate access. Insider threats can be malicious and intentional or unintentional and caused by carelessness or lack of training.
Shadow IT
IT systems, devices, software, applications, and services used or managed without explicit organizational approval. Shadow IT creates security risk because the IT department cannot monitor, patch, or protect assets it does not know exist.
Honeypot
A decoy system or server designed to attract and deceive potential attackers by simulating real-world IT assets. Used to study attacker techniques and detect intrusion attempts.
Honeynet
An entire network of decoy systems (multiple honeypots) used to observe complex, multi-stage attacks and gather intelligence on attacker behavior.
Honeyfile
A decoy file placed within a system to detect unauthorized access or data breaches. If the file is accessed, it triggers an alert — no legitimate user would open it.
Honeytoken
Fake pieces of data — such as fabricated user credentials — inserted into a database or system. When accessed or used, they immediately alert administrators to a breach or insider threat.
10 Threat Actor Motivations
The exam tests the full list — know all ten:
- Data Exfiltration — stealing sensitive data for use or sale
- Blackmail — leveraging stolen data to extort victims
- Espionage — gathering intelligence on targets (governments, corporations)
- Service Disruption — making systems unavailable (DoS/DDoS)
- Financial Gain — direct monetary theft, ransomware, fraud
- Philosophical or Political Beliefs — hacktivism, ideological agenda
- Ethical Reasons — exposing wrongdoing (e.g. whistleblowing hackers)
- Revenge — insider threats acting against a former or current employer
- Disruption or Chaos — causing disorder without a specific financial goal
- War — nation-state offensive cyber operations against adversaries
3 Threat Actor Attributes
Attributes differentiate threat actors from one another — the exam tests all three:
- Internal vs External — insider threats are internal; most others are external
- Resourcing and Funding — ranges from self-funded (unskilled) to government-funded (nation-state)
- Sophistication and Capability — ranges from script kiddie (low) to nation-state (very high)
5 Threat Actor Types — Overview
Know the defining characteristic of each for scenario questions:
- Unskilled Attacker — uses pre-built tools; lowest sophistication
- Hacktivist — ideologically motivated; targets organizations for exposure/attention
- Organised Crime — financially motivated; ransomware, identity theft, fraud
- Nation-State — government-sponsored; espionage, sabotage, cyber warfare; highest resources
- Insider Threat — within the org; malicious (revenge) or unintentional (carelessness)
4 Deception and Disruption Technologies
Used to detect attackers and gather intelligence — know the difference between each:
- Honeypot — single decoy system/server; lures attackers and records their techniques
- Honeynet — full network of decoy systems; captures multi-stage attack behavior
- Honeyfile — decoy file; any access triggers an alert (no legitimate user touches it)
- Honeytoken — fake data (e.g. fake credentials) in a real system; use of the token = breach indicator
Domain 2 exam objectives covered in this section
Obj 2.1 = compare and contrast common threat actors and motivations. Obj 2.2 = explain common threat vectors and attack surfaces. Both are Domain 2 (22% of exam) — high priority.
Match the motivation to the actor type
Financial gain → Organised Crime. Ideology/cause → Hacktivist. Espionage/warfare → Nation-State. Revenge/carelessness → Insider Threat. Curiosity/free tools → Unskilled Attacker. The exam describes a motivation and asks which actor type fits.
Nation-State = highest sophistication AND highest resources
On any question asking which threat actor has the most resources, funding, or capability — Nation-State is always the answer. They have government backing, dedicated teams, and long-term objectives.
Honeytoken vs Honeyfile — different trigger mechanism
Honeyfile: a fake file — accessing/opening it triggers the alert. Honeytoken: fake data (credentials, records) embedded in a real system — USING the token (e.g. logging in with fake creds) triggers the alert. Exam tests which one applies to a given detection scenario.
Shadow IT = risk from ungoverned assets
Shadow IT is not an attack — it is a risk created when employees use unapproved technology. The organization cannot monitor, patch, or protect what it does not know exists. Exam scenario: 'employee used a personal cloud storage app for company data' → Shadow IT.
Threat Actor Motivations
Intent (Threat Actor)
The specific objective or goal a threat actor aims to achieve through an attack. Intent describes what the attacker wants to accomplish, which is distinct from motivation.
Motivation (Threat Actor)
The underlying reason or driving force that pushes a threat actor to carry out an attack. Motivation explains why the attacker acts, not what specific objective they are trying to accomplish.
Data Exfiltration
The unauthorized transfer of data from a computer system. Target data includes IP (intellectual property), PII, and trade secrets. Uses: sold on dark web, identity theft, or competitive advantage.
Hacktivism
Use of hacking techniques to promote a political agenda, social change, or protest against organizations perceived as unethical. Common actions: website defacement and data leaks.
Doxxing
Publicly revealing an individual's private or personal information without consent. Used as a blackmail or retaliation tactic.
Sextortion
A form of cyber blackmail where an attacker steals intimate images and threatens to release them publicly unless a payment is made.
Cyber Espionage
Covert gathering of sensitive or classified information via cyber means. Conducted by nation-states (national security), rival companies (competitive intelligence), or hacktivists (political advantage).
Cyber Warfare
Nation-state use of digital attacks to disrupt adversary infrastructure, compromise national security, or cause economic damage. Driven by geopolitical objectives.
Intent vs Motivation — Two Distinct Concepts
Intent = the specific goal (what the attacker wants to achieve). Motivation = the underlying reason (why they are attacking). The exam tests both as separate, distinguishable terms.
10 Threat Actor Motivations
The exam tests the full list — know all ten:
- Data Exfiltration — unauthorized data theft; targets IP, PII, trade secrets
- Financial Gain — most common motivation; ransomware, banking Trojans
- Blackmail — leverage stolen/compromising info to extort; payment often in cryptocurrency
- Service Disruption — overwhelm with DDoS to make services unavailable
- Philosophical or Political Beliefs — hacktivism; website defacement, data leaks
- Ethical Reasons — ethical hackers (pen testers, bug bounty hunters) improving security
- Revenge — disgruntled/former employee; data breach, service disruption, leaking info
- Disruption or Chaos — thrill-seeking or causing harm with no specific financial goal
- Espionage — intelligence gathering against governments, corporations, or political targets
- War — nation-state offensive cyber operations; geopolitical objectives
3 Forms of Cyber Blackmail
Blackmail uses compromising information as leverage — know all three forms:
- Ransomware — encrypts victim's data; demands payment to restore access
- Doxxing — threatens to publicly release personal/private information
- Sextortion — threatens to release stolen intimate images unless payment is made
Intent ≠ Motivation — the exam distinguishes these
Intent = what the attacker wants to achieve (e.g. gain access to financial records). Motivation = why they are attacking (e.g. financial gain). A scenario asking 'what motivates this attacker' wants the underlying reason, not the tactical goal.
Financial Gain = most common motivation for cybercriminals
When the exam describes an attacker with no stated ideology, political cause, or insider connection — default to financial gain. Ransomware and banking Trojans are the flagship financial-gain techniques.
Espionage vs War — different scale and objective
Espionage = covert intelligence gathering (secrets, competitive data, political advantage) — conducted by nation-states AND rival companies. War = offensive attacks to cause disruption, damage infrastructure, or create economic harm — conducted exclusively by nation-states.
Ethical hackers are NOT malicious — motivation is ethical reasons
Scenario: 'security professional paid to find vulnerabilities' → motivation = ethical reasons. Pen testers and bug bounty hunters mimic malicious attackers to improve defences, not to cause harm.
Blackmail payment = untraceable cryptocurrency
Exam scenarios involving blackmail or ransomware demand payment in cryptocurrency (e.g. Bitcoin) because it is difficult to trace. This is a consistent pattern — if the question mentions untraceable payment, the motivation is blackmail or financial gain via ransomware.
Threat Actor Attributes
Internal Threat Actor
An individual or entity within the organization who poses a security threat. Includes employees, contractors, and business associates with legitimate access who misuse it.
External Threat Actor
An individual or group outside the organization attempting to breach its defences. Includes cybercriminals, hacktivists, competitors, and state-sponsored actors. Has no authorized access — must use malware or social engineering to gain entry.
Resources and Funding
The tools, skills, and personnel available to a threat actor. Directly influences the scale, frequency, and sophistication of their attacks — from a single personal computer to government-backed teams with large budgets.
Sophistication and Capability
The technical skill level of a threat actor and the complexity of tools and techniques they employ, including their ability to evade detection. Rated on a low-to-high scale.
APT — Advanced Persistent Threat
A highly sophisticated threat actor, often nation-state or state-sponsored, that penetrates a well-defended network and maintains unauthorized access for an extended period while avoiding detection. An Advanced Persistent Threat (APT) is defined by both advanced capability and persistence.
3 Threat Actor Attributes
Every threat actor is characterised by these three attributes — the exam tests all three:
- Internal vs External — based on the actor's relationship to the targeted organization
- Resources and Funding — tools, skills, personnel, and budget available to the actor
- Sophistication and Capability — technical skill level and complexity of techniques used
Internal vs External — Key Distinctions
The defining difference is authorized access and organizational relationship:
- Internal — has legitimate access; damage potential amplified by insider knowledge of systems and vulnerabilities
- External — no authorized access; must use attack techniques (malware, social engineering) to penetrate
- Internal motivations: revenge, financial gain, coercion by external entities
Sophistication Scale — Low to High
Two anchor points the exam tests:
- Low: Script Kiddie — uses pre-made tools and scripts without understanding the underlying principles; common malware and phishing
- High: Nation-State / APT — custom-developed malware, zero-day exploits, advanced evasion techniques, extended undetected presence
Internal threat actor = legitimate access misused
Exam scenario: 'employee downloaded company data to a personal drive' → Internal threat actor. Key signal: they already had authorized access. External actors must break in — internal actors abuse existing access.
APT = persistence + high sophistication, not just skill
An APT is not merely a skilled attacker — the defining characteristic is maintaining undetected access for extended periods. If the scenario describes a long-term hidden presence in a network, the answer is APT or nation-state, not script kiddie or hacktivist.
Nation-State = highest resources AND highest sophistication
On any question asking which threat actor has the most resources, funding, or capability — Nation-State is always the answer. They have government backing, dedicated teams, zero-day exploit budgets, and long-term strategic objectives.
Resources/funding determines attack scale — not intent
A threat actor's resources affect HOW they attack (scale, frequency, tools) — not WHY they attack. Do not confuse resources with motivation on scenario questions.
Unskilled Attackers
Low Orbit Ion Cannon (LOIC)
A freely available DDoS tool used by unskilled attackers. The attacker enters a target IP and launches an attack with a single click. Demonstrates how zero technical knowledge is required to execute a DDoS using pre-built tools.
Unskilled Attacker Profile — 3 Characteristics
Know all three — the exam contrasts these against other actor types:
- Low Skill — lacks the knowledge to develop their own hacking tools or exploits
- Low Resources — self-funded; no organizational or government backing
- Pre-built Tools Only — cannot create or modify tools; downloads and runs scripts written by others
Script Kiddie Motivations — 3 Types
Distinct from all other threat actor motivations — not financial, not political:
- Recognition / Notoriety — seeking fame among peers by defacing websites or disrupting networks
- Thrill / Disruption — excitement from causing disorder without a specific target
- Curiosity — exploring and understanding digital systems through hacking
Opportunistic vs Targeted Nature
Script kiddies are opportunistic — they focus on easier, lower-value targets where success is more likely. They do not pursue specific high-value organizations the way hacktivists or nation-state actors do.
Why Unskilled Attackers Are Still Dangerous
Three factors make them a sizable threat despite low individual capability:
- Volume — large numbers can coordinate; a collective DDoS can overwhelm a target
- Readily Available Tools — no technical barrier; attack tools are freely downloadable
- Unpatched Systems — exploit known, publicly disclosed vulnerabilities on systems that haven't been patched
DDoS launched with a simple downloaded tool → Unskilled Attacker
Exam scenario: 'attacker downloaded a tool, entered an IP, and launched a DDoS with a single click' → Unskilled Attacker / Script Kiddie. The signal is pre-built tool + zero customisation + no technical expertise required.
Script Kiddie motivation ≠ Financial ≠ Political
Financial gain → Organised Crime. Political/ideological cause → Hacktivist. Curiosity, recognition, thrill → Unskilled Attacker. Script kiddies are the only threat actor type not driven by financial or political objectives — the exam tests this mapping.
Opportunistic target selection = Script Kiddie
If the scenario describes an attack on a random or easy target — not a specific organization, individual, or industry — the actor type is Unskilled Attacker. Hacktivists, organized crime, and nation-states all select their targets deliberately.
Hacktivists
Hacktivism
The use of hacking and other cyber techniques to promote or advance a political or social cause. Combines 'hacking' and 'activism'. Attacks are a means of protest or drawing attention — not a path to financial gain.
Hacktivist
An individual or group that uses technical skills to promote a cause or drive social change rather than for personal or financial gain. Motivated by ideological beliefs; target selection is driven by those beliefs.
Anonymous
The most well-known hacktivist collective — loosely affiliated, no central leadership. Launched Operation Payback (2010): DDoS attacks against MPAA and RIAA in protest of digital anti-piracy efforts.
LulzSec
Hacktivist group that conducted '50 Days of Lulz' (2011), targeting Sony, the CIA, and the FBI. Mixed motivations: chaos (the 'lulz') combined with political opposition to censorship and surveillance.
Website Defacement
A hacktivist technique that alters the visual content of a target's website to spread a message. Functionally a form of digital vandalism. Goal is public attention, not system damage.
Doxxing (Hacktivist Context)
Public release of private information about an individual or organization (name, address, phone, email) to expose them. Hacktivists use doxxing hoping others will take real-world action against the victim.
4 Hacktivist Techniques
The exam may list these — know all four and what each achieves:
- Website Defacement — altering a site's appearance to broadcast a message; a form of digital vandalism
- DDoS — overwhelming systems so legitimate users cannot access them; causes service disruption
- Doxxing — releasing private info publicly; intended to incite real-world harm against the target
- Sensitive Data Leak — stealing and publicly releasing an organization's confidential data
Hacktivist Sophistication — Variable but Potentially High
Hacktivists range widely in skill. Some groups contain advanced members who can develop custom exploits and attack well-defended systems — higher sophistication than script kiddies but typically below nation-state level.
Hacktivist Target Selection
Targets are chosen based on perceived ethical violations — not randomly (unlike script kiddies). Common target categories:
- Governments — censorship, surveillance, political oppression
- Corporations — environmental damage, human rights abuses, unethical practices
- Anti-piracy organizations — interference with open internet (e.g. Operation Payback)
Hacktivist motivation = ideological, NOT financial
If the scenario states the attacker is protesting, promoting a cause, or targeting a perceived injustice → Hacktivist. If the goal is money → Organised Crime. This is the single most-tested distinction between these two actor types.
Website defacement = Hacktivist technique
Scenario: 'attacker replaced a corporation's homepage with a political message' → Hacktivist. Defacement is a form of digital vandalism — its purpose is public messaging and embarrassment, not data theft or ransom.
Hacktivist sophistication > Script Kiddie
On sophistication-ranking questions: Hacktivists > Script Kiddies. Some hacktivist groups can write custom exploits and target hardened systems. Script kiddies only use pre-built tools they do not understand.
Doxxing intent = incite third-party real-world harm
Doxxing is not just data exposure — the intent is that someone else will act on the released information. This distinguishes doxxing from a generic data leak. If the scenario mentions releasing personal addresses or phone numbers to the public, the technique is doxxing.
Organized Crime
Organized Cybercrime
Sophisticated, well-structured criminal syndicates that conduct illegal activities in the digital realm for financial gain. Members are assigned specific roles based on skills. Operates across national borders, complicating law enforcement prosecution.
FIN7
A sophisticated cybercrime syndicate targeting the retail and hospitality industries via advanced phishing campaigns — crafted emails and fake websites that steal login credentials or install malware.
Carbanak Group
Organized cybercrime group that stole over $1 billion from banks worldwide using custom malware (also called Carbanak) to infiltrate banking networks, manipulate account transfers, and remotely dispense cash from ATMs.
Mercenary / Hired Gun (Cybercrime Context)
Organized crime groups may be contracted by governments or other entities to conduct cyber operations on their behalf. When acting in a political context, their motivation remains financial — they are not ideologically driven.
Organized Cybercrime — 4 Key Characteristics
Know all four for scenario identification questions:
- Well-structured — members assigned specific roles based on skill and expertise
- High technical capability — custom malware, ransomware, sophisticated phishing campaigns
- Highly adaptive — continuously evolve methods in response to new security measures
- Transnational — operate across borders, increasing law enforcement complexity
Organized Crime Motivation — Financial Gain Only
Primary and near-exclusive motivation is financial gain. Common revenue methods:
- Data breaches — stolen data sold or leveraged for fraud
- Identity theft — PII used to open fraudulent accounts
- Online fraud — scams, fake transactions
- Ransomware attacks — encrypting systems and demanding payment
Organized Crime Target Profile
Targets are selected for financial value, not ideology. Preferred targets:
- Small and medium-sized businesses — often under-defended relative to data value
- High-net-worth individuals — substantial financial resources
- Banks and financial institutions — direct access to money (e.g. Carbanak)
Evasion Technologies Used by Organized Crime
Three categories the exam may reference:
- Cryptocurrencies — untraceable payment and money laundering
- Dark web — anonymous marketplaces for stolen data and criminal services
- Cellular collection devices (IMSI catchers) — intercept communications to evade detection
Organized Crime motivation = financial, NOT ideological
If the scenario describes attackers motivated by money — ransomware demand, stolen credit cards, bank fraud — the actor type is Organized Crime. If the motivation is a cause or belief → Hacktivist. This is the primary exam distinction between these two actor types.
Organized Crime acting politically = still financially motivated
If the scenario says a crime group was hired by a government to conduct attacks, their motivation is still financial — they are mercenaries, not ideological actors. Do not select Hacktivist or Nation-State just because a political element is present.
Organized Crime sophistication > Hacktivist > Script Kiddie
On sophistication-ranking questions: Organized Crime groups are highly sophisticated — custom tools, coordinated campaigns, adaptive TTPs. Place them above hacktivists (variable skill) and far above script kiddies (pre-built tools only). Nation-State remains the highest tier.
Ransomware + coordinated campaign → Organized Crime
Scenario: 'well-planned ransomware attack targeting a hospital's financial systems' → Organized Crime. Ransomware for financial extortion is the signature tactic of cybercrime groups, not hacktivists or nation-states (who prefer persistence and espionage).
Nation-State Actors
Nation-State Actor
A group or individual sponsored by a government to conduct cyber operations against other nations, organizations, or individuals. Usually part of intelligence or military organizations, or operates as an independent entity with state-backed resources to give the sponsoring country plausible deniability.
False Flag Attack
An attack orchestrated to appear as if it originates from a different source or group than the actual perpetrators. Intent is to mislead investigators and misattribute the attack. Example: 2018 Winter Olympics malware — Russian actors mimicked North Korean TTPs to avoid attribution.
Advanced Persistent Threat (APT)
A prolonged and targeted cyberattack in which an intruder gains unauthorized access to a network and remains undetected for an extended period to steal data or monitor activity — rather than cause immediate damage. Originally synonymous with nation-state actors; now also applied to sophisticated organized crime groups.
Plausible Deniability
A nation-state's ability to deny involvement in a cyber operation by using independent proxy groups or contracted cybercrime actors. Allows governments to conduct offensive cyber operations while maintaining official distance.
Stuxnet
Nation-state malware (attributed to USA and Israel) deployed in 2011 to physically sabotage Iran's nuclear enrichment centrifuges. Spread via infected USB drives to bypass air-gapped networks. First publicly known malware to cause real-world physical damage to industrial systems.
Air Gap
A security measure where a system is physically isolated from unsecured networks (including the internet). Stuxnet defeated an air gap by targeting USB drives as the infection vector — an employee unknowingly carried the worm into the secure environment.
Nation-State Actor Capabilities
The highest technical tier — capabilities that define this actor type:
- Custom malware — purpose-built tools tailored to specific targets
- Zero-day exploits — attack vulnerabilities with no existing patch
- APT operations — long-term, stealthy persistence in compromised networks
- Complex coordinated campaigns — multiple techniques, stages, and vectors
Nation-State Motivations — Primarily Strategic, Not Financial
Motivations are geopolitical, with one key exception:
- Intelligence gathering — cyber espionage to collect classified or strategic information
- Disrupting critical infrastructure — destabilising adversary nations
- Influencing political processes — election interference, disinformation campaigns
- Stealing intellectual property — competitive advantage in key industries
- Exception — North Korea: financially motivated due to sanctions and economic isolation; targets banks and cryptocurrency exchanges
APT vs Nation-State — Important Distinction
APT originally meant nation-state actor, but the term has expanded. Key distinction the exam tests:
- APT = any prolonged, stealthy, targeted intrusion — nation-state OR sophisticated organized crime
- Nation-State = always government-sponsored; always qualifies as APT-level
- Organised Crime = may be classified as APT if they demonstrate long-term persistence and high sophistication
False Flag Attack — How It Works
Nation-state actors deliberately mimic the TTPs (tools, techniques, procedures) of another known actor group to redirect attribution. The 2018 Winter Olympics attack shows the pattern: Russian actors planted indicators pointing to North Korea to mislead forensic investigators.
Nation-State = highest resources AND highest sophistication
Any question asking which threat actor has the most resources, funding, capability, or technical sophistication — Nation-State is the answer. Government backing, dedicated teams, zero-day budgets, and long-term strategic objectives place them above all other actor types.
Nation-State motivation = strategic/political, NOT financial — except North Korea
If the scenario describes espionage, infrastructure disruption, or election interference → Nation-State. If the scenario describes a nation-state targeting banks or crypto exchanges → North Korea specifically. North Korea is the only nation-state actor primarily motivated by financial gain.
False flag attack = attribution is intentionally wrong
Scenario: 'investigators initially attributed the attack to Group A, but further analysis revealed Group B mimicked Group A's techniques' → False Flag Attack. The hallmark is deliberate TTP mimicry to mislead forensic attribution.
Air gap bypass via USB = Stuxnet pattern
Scenario: 'malware spread to an isolated network via a USB drive carried in by an insider' → air gap bypass technique. Stuxnet is the reference case. The exam may describe this vector without naming Stuxnet — recognise the pattern.
APT = long-term undetected access, not just skill
If the scenario describes an attacker who was inside a network for months without detection — stealing data quietly — the answer is APT, not just 'skilled attacker'. Persistence and stealth are the defining APT characteristics, not capability alone.
Insider Threats
Insider Threat
A cybersecurity risk posed by current or former employees, contractors, or business associates who have legitimate access to an organization's systems and data, and who may misuse that access for malicious or unintended purposes.
Malicious Insider
An insider who intentionally misuses their access to cause harm. Motivations include financial gain (selling data), revenge (fired employee leaking data), or espionage. Has awareness of systems, security processes, and vulnerabilities that external attackers lack.
Unintentional Insider (Negligent Insider)
An insider who causes a security incident through carelessness or lack of security awareness — not malicious intent. Classic example: untrained employee clicking a phishing link that compromises the network.
Edward Snowden (NSA, 2013)
Former NSA contractor who leaked classified global surveillance program data to the media. Classified as an insider threat by the US government. Described by the Director of National Intelligence as 'the most massive and most damaging theft of intelligence information in US history.'
Twitter Insider Attack (2020)
An external attacker collaborated with two Twitter insiders to access high-profile accounts (Obama, Biden, Musk, Gates, others) and run a Bitcoin scam. Demonstrates that external attackers can weaponise insiders to bypass perimeter controls.
2 Types of Insider Threat
The exam distinguishes these — know both and their signals:
- Malicious — intentional; motivated by financial gain, revenge, or ideology; may steal data, install backdoors, or sabotage systems
- Unintentional / Negligent — accidental; caused by carelessness, poor security hygiene, or lack of training (e.g. clicking phishing links)
Insider Threat Capability — 2 Determining Factors
Capability is not determined by access level alone — both factors interact:
- Level of Access — higher privilege (e.g. sysadmin) increases potential damage scope
- Personal Knowledge and Skill — a skilled attacker with a standard user account can cause more damage than an unskilled sysadmin with elevated access
4 Forms Insider Threats Can Take
Know all four — the exam may describe a scenario and ask which form applies:
- Data Theft — stealing and exfiltrating sensitive organizational data
- Sabotage — intentionally damaging systems, data, or operations
- Misuse of Access Privileges — accessing resources beyond authorized scope
- Facilitating External Attack — installing malware or creating backdoors for an external actor
Why Insider Threats Are More Dangerous Than External Threats
Three structural advantages insiders hold over external attackers:
- Legitimate access — no need to breach perimeter defences
- Institutional knowledge — aware of security processes, system layout, and vulnerabilities
- Trust — actions are less scrutinised; anomalies are attributed to legitimate work
4 Controls to Mitigate Insider Threats
Core mitigations — exam may test which control addresses insider risk:
- Zero Trust Architecture — never trust, always verify; no implicit trust based on network location or role
- Robust Access Controls — least privilege; limit what each user can access to only what they need
- Regular Audits — detect anomalous access patterns before damage escalates
- Security Awareness Training — reduces unintentional insider incidents caused by negligence
Insider threat = legitimate access misused — the key signal
Scenario: 'employee copied customer records to a personal drive before resigning' → Insider Threat (Malicious). Scenario: 'employee clicked a phishing link that installed malware' → Insider Threat (Unintentional). The signal in both cases: the actor already had authorized access — no perimeter breach required.
Malicious vs Unintentional — motivation is the differentiator
If the scenario describes intent to harm, profit, or revenge → Malicious Insider. If the scenario describes carelessness, lack of training, or accidental action → Unintentional/Negligent Insider. The exam tests which type applies to a given scenario.
External attacker + insider collaboration = still an insider threat
Twitter 2020: an outside attacker recruited insiders to execute the attack. The threat vector is still classified as an insider threat because legitimate internal access was exploited. Do not select 'external attacker' just because an outsider initiated the attack.
Zero Trust is the primary architectural defence against insider threats
If the scenario asks 'which security model best mitigates insider threats?' → Zero Trust. Zero Trust removes implicit trust granted by being inside the network perimeter — every access request is verified regardless of who is asking.
Shadow IT
Shadow IT
The use of IT systems, devices, software, applications, and services without explicit organizational approval. Also called stealth IT or client IT. Managed outside the IT department's knowledge — IT cannot monitor, patch, or secure what it does not know exists.
BYOD — Bring Your Own Device
A policy or trend where employees use personal smartphones, tablets, or laptops to access work email, documents, or systems. Personal devices may lack the security controls applied to corporate-managed devices, making them a potential attack surface.
3 Common Forms of Shadow IT
The exam may describe a scenario — identify which form applies:
- Personal devices for work — BYOD; smartphones, tablets, laptops not managed by IT
- Unapproved software / browser extensions — installed by users to improve efficiency without IT sanction
- Unsanctioned cloud services — using Dropbox, Google Drive, or other cloud apps for work data without IT approval
Why Shadow IT Arises
Two root causes to know:
- Security posture set too high — IT processes are too slow or complex, so employees bypass them to get work done
- Desire for efficiency and convenience — employees self-select tools that suit their workflow better than approved options
3 Security Risks of Shadow IT
Know all three — the exam tests which risk shadow IT introduces:
- Data breaches — unsanctioned devices or cloud services may expose sensitive data
- Non-compliance with regulations — unmanaged assets may violate data handling requirements (GDPR, HIPAA, PCI-DSS)
- System disruptions — unvetted software or hardware may introduce malware or instability
Core Security Problem — IT Cannot Secure the Unknown
The fundamental risk: if the IT department does not know a device, application, or cloud service exists on the network, it cannot patch it, monitor it, or respond to incidents involving it. Lack of visibility = inability to protect.
Shadow IT = unapproved technology, not malicious intent
Shadow IT is not an attack — it is a risk created by employees acting without IT approval, often to boost productivity. Exam scenario: 'employee used a personal cloud storage app to share project files' → Shadow IT. The employee is not an insider threat unless there is malicious intent.
Shadow IT vs Insider Threat — intent is the dividing line
Shadow IT: employee uses unapproved tech for convenience, no intent to harm. Insider Threat (malicious): employee intentionally misuses access. A phishing click is an unintentional insider threat, not shadow IT. Identify which risk category the scenario fits by checking for intent.
BYOD is a subset of Shadow IT
BYOD devices brought to work without IT management are shadow IT. The risk is the same: IT cannot apply security controls to a device it does not manage. If the scenario mentions personal devices accessing corporate resources without IT oversight → Shadow IT / BYOD risk.
Browser extensions and plugins = shadow IT
Unapproved browser extensions installed by employees are shadow IT. They can introduce data exfiltration risk or malware without IT's knowledge. If the scenario describes unauthorized software a user installed themselves → Shadow IT.
Threat Vectors & Attack Surfaces
Threat Vector
The means or pathway by which an attacker gains unauthorized access to a computer or network to deliver a malicious payload or carry out an unwanted action. The HOW of an attack.
Attack Surface
The sum of all points where an unauthorized user can try to enter or extract data from an environment — all potential vulnerabilities and entry points an attacker could exploit. The WHERE of an attack.
Baiting
A social engineering technique using removable devices. An attacker leaves a malware-infected USB drive where a target is likely to find it (e.g. parking lot, lobby). When the target plugs it in, malware may be installed and executed.
Evil Twin
A rogue wireless access point that mimics a legitimate organization Wi-Fi network. When users connect to the evil twin, the attacker can intercept, capture, and modify their network traffic.
BlueBorne
A set of Bluetooth vulnerabilities that allow an attacker to take over devices, spread malware, or conduct an on-path attack to intercept communications — without any user interaction or device pairing.
BlueSmack
A Bluetooth denial-of-service attack. Sends a specially crafted L2CAP (Logical Link Control and Adaptation Protocol) packet to a target device, exhausting its resources and causing it to crash or become inoperable.
Stegano Attack (2017)
A large-scale image-based attack where malicious code was embedded in the pixels of banner ads on popular websites. Exploited vulnerabilities in Internet Explorer to silently redirect victims to exploit kit-hosting sites and install malware with no visible indication.
Vishing
Voice call-based threat vector. Attacker impersonates a trusted entity (bank, IRS, service provider) over phone to trick victims into revealing sensitive information such as credentials, SSNs, or payment card details.
Threat Vector vs Attack Surface — Key Distinction
Threat Vector = HOW the attacker gets in (the method/pathway). Attack Surface = WHERE they could get in (all exploitable entry points). Reducing the attack surface limits available threat vectors.
6 Threat Vectors to Know
All six are testable — know each:
- Messages — email, SMS, instant messaging; phishing, malicious links/attachments
- Images — malicious code embedded in image files (steganography); executes on load
- Files — disguised malicious documents or software via email, file sharing, or malicious sites
- Voice Calls — vishing; impersonation over phone to extract sensitive information
- Removable Devices — USB drives and external storage; baiting or direct physical insertion
- Unsecured Networks — Wi-Fi, wired, Bluetooth; interception, rogue APs, Bluetooth exploits
3 Unsecured Network Sub-Vectors
Each network type has specific attack techniques the exam may reference:
- Wireless (Wi-Fi) — evil twin / rogue access point; traffic interception on open networks
- Wired — physical cable tapping; MAC address cloning; VLAN hopping
- Bluetooth — BlueBorne (device takeover, on-path, no interaction); BlueSmack (DoS via L2CAP packet)
How to Reduce the Attack Surface
Three core controls — applied per network segment:
- Restrict access — limit who and what can connect
- Remove unnecessary software — eliminate unused applications and services
- Disable unused protocols — close off protocol-level entry points not needed for operations
Threat vector = HOW; attack surface = WHERE — never confuse these
Exam may ask: 'what does minimizing the attack surface achieve?' → Reduces the number of pathways (threat vectors) available to an attacker. Or: 'an attacker used email to deliver malware — what is this?' → Message-based threat vector, not attack surface.
Baiting = physical removable device left for victim to find
Scenario: 'a USB drive was found in the company car park; an employee plugged it in and malware executed' → Baiting (removable device threat vector). Distinguish from vishing (voice) or phishing (message).
Evil Twin = rogue AP mimicking legitimate Wi-Fi
Scenario: 'users connected to what appeared to be the office Wi-Fi but their traffic was being intercepted' → Evil Twin attack. The signal: the fake network name matches the real one.
BlueBorne requires no user interaction — that is the key exam signal
Most Bluetooth attacks require pairing. BlueBorne does not — the attacker can take over a device or intercept communications with zero user action. If the scenario states no interaction occurred → BlueBorne, not a generic Bluetooth attack.
Image-based attack = malicious code hidden in image file (steganography)
Scenario: 'malware was distributed via banner ads; no file was downloaded by the user' → Image-based threat vector / steganography. The Stegano 2017 attack is the reference case — code embedded in pixels, executed by a vulnerable browser.
Deception & Disruption Technologies
TTPs — Tactics, Techniques, and Procedures
The specific methods and patterns of activity associated with a particular threat actor or group. TTPs describe HOW an adversary operates. Collected via deception technologies (honeypots, honeynets) and used by defenders to detect, attribute, and counter attacks.
Screened Subnet (Honeypot Placement)
The recommended network location for a honeypot — an isolated segment accessible from the internet but separated from production systems. Allows attackers to reach and interact with the honeypot without exposing real assets.
Bogus DNS Entry
A fake DNS record added to an organization's DNS server. Misleads attackers into resolving non-existent domains or redirects them to trap systems. Wastes attacker resources and triggers defender alerts when queried.
Decoy Directory
Fake folders and files placed in system storage. Any unauthorized access or modification raises an alert. The attacker is misled into believing they have accessed genuine resources, buying defenders time to respond.
Port Triggering
A mechanism where ports and services remain closed and invisible to port scanners until a specific outbound traffic pattern is detected. Once triggered, the port opens temporarily for legitimate users. Hides services from attacker reconnaissance.
Fake Telemetry Data
False network or system data sent in response to a detected scan. Misleads the attacker about the real OS, services, or network layout — causing exploits built on false information to fail. Example: reporting Windows 11 to a scanner when the system is actually macOS.
Honeypot — Purpose and Placement
Primary purpose is intelligence gathering, NOT blocking attacks. Key operational details:
- Logs all interactions to reveal attacker TTPs, methods, and motives
- Can detect insider threats — internal fraud, snooping, malpractice
- Can run as a real system or emulated/simulated environment
- Must be placed in a screened subnet or isolated segment accessible from the internet
Honeyfile — Technical Detail
More than a simple decoy file — it can actively respond:
- Contains fake data with hidden metadata or digital watermarks for tracking if stolen
- Deliberately placed under looser security than real sensitive files to appear accessible
- Can embed code that enumerates the attacker's own network when the file is opened
- Any file type can be used: documents, spreadsheets, images, databases, executables
Honeytoken — Use Cases
Three specific honeytoken forms the exam may reference:
- Fake user account — e.g. an 'Admin' or 'Root' account no legitimate user would log into
- Bogus URL — a link that should never be clicked by a legitimate user
- Dummy database record — a fake entry that should never appear in legitimate queries
Honeynet — Purpose and Use
A network of honeypots mimicking an entire environment — servers, routers, switches. Key characteristics:
- Used by large organizations and research institutions to study threat actor behavior at scale
- Logs both successful and unsuccessful attacks to reveal patterns across multiple attack vectors
- Provides richer TTP intelligence than a single honeypot — captures multi-stage, coordinated attack behavior
- Can run as real hardware or emulated systems
Honeynet Risk — Double-Edged Sword
Honeynets carry a unique risk not present in single honeypots: an attacker who probes the honeynet can learn how the real production systems are configured if the honeynet too closely mirrors them. This intelligence can be used to attack the real environment.
5 Disruption Strategies
In addition to the 4 deception technologies, these active disruption methods hinder attacker reconnaissance and operations:
- Bogus DNS entries — fake DNS records that waste attacker time and trigger alerts
- Decoy directories — fake folders/files that alert on unauthorized access
- Dynamic page generation — ever-changing web content defeats automated scrapers and bots
- Port triggering — keeps services hidden from port scanners; opens only on valid outbound trigger
- Fake telemetry data — false OS/service data returned to scanners defeats OS fingerprinting
Honeypot purpose = gather intelligence, NOT block attacks
If the exam asks what a honeypot is designed to do — the answer is collect information about attacker TTPs and methods. Honeypots do not prevent or stop attacks. Confusing this with a firewall or IPS is a common wrong-answer trap.
Honeytoken trigger = no legitimate use; any access = breach
Honeytokens have zero legitimate function. If any user — internal or external — accesses or uses a honeytoken, it is an unambiguous indicator of compromise. This makes them especially effective for detecting insider threats who have authorized access to the surrounding systems.
Honeyfile vs Honeytoken — the trigger mechanism differs
Honeyfile: opening or accessing the file triggers the alert. Honeytoken: using the data (e.g. logging in with fake credentials, clicking a bogus URL) triggers the alert. Exam scenario: 'attacker used a set of credentials that existed only as a trap' → Honeytoken, not honeyfile.
TTPs = the behavioral fingerprint of a threat actor
When a scenario describes investigators matching attack patterns to a known group — or defenders using past attack data to predict future behavior — the concept being tested is TTPs. TTPs are collected via deception technologies and threat intelligence feeds.
Port triggering hides services from port scanners
Scenario: 'a service is not visible during an attacker's port scan but becomes available to authorized users' → Port triggering. Distinguish from a firewall rule, which blocks access; port triggering keeps the port closed and undetectable until a valid pattern is observed.