The definition of a threat actor is an entity
responsible for an event that has
an impact on the safety of another entity.
Sometimes you'll hear this referred to
as a malicious actor.
This is usually the entity that you're
trying to protect your network and your data from.
This is the bad guy.
There are many different categories of threat actors.
And in this video, we'll step through some
of those major categories and examine
some of the motivations they use behind their attacks.
In many of these examples, you'll
find that the threat actors are looking
to implement an APT, that is an advanced persistent threat.
It is a threat that's able to get into your network
because it is advanced.
It's persistent because once they get into your network,
they are there until you take them out.
And obviously, the threat part of this
means that they are after something that's
on the inside of your network.
What's interesting about this is how long
it takes to finally identify that one of these threat actors
has infiltrated and is living inside of your network.
In a report from FireEye in 2018,
they showed the average is 71 days in North and South America
for attackers to be in the network and undetected.
This goes up to 177 days in Europe, the Middle
East, and Africa.
And in Asia-Pacific, 204 days before anyone
realizes that the attacker is now inside of the network.
Some of the most dangerous threat actors
are the ones that are inside of your network already.
These may be employers or contractors that
work for your organization.
And these are the insiders that have a lot of control
and a lot of reign over what they
can do inside of your network.
It's unlikely that a threat actor who's an insider
is someone who works at being a hacker 24 hours a day,
seven days a week.
They probably have a different job that they're doing inside
of your organization, and therefore, the attacks they use
may not be as sophisticated as perhaps
a more advanced attacker.
But the insider knows things that the hacker doesn't.
They know where your data center is located.
They know how your network is designed.
They understand the security tools
that you already are using inside of your network.
So they can direct their efforts towards the most vulnerable
systems or the systems that they may have the most access to.
This is a huge advantage that an insider has over
someone who may be trying to get in from the outside.
And because the insider is walking
through the front door every day and connecting to your network,
they have a huge number of resources
available to try to find data and exfiltrate that information
from your organization.
A threat actor who is a nation state is usually a government.
This is an organization, usually in charge of national security.
And it's almost always an external government entity.
Governments tend to have many resources available
so they can hire the smartest technologists
and gather the security experts in that particular area.
A good example of a nation state being a threat entity
is the United States and Israel team together,
to destroy about 1,000 nuclear centrifuges with a worm that
was sent to Iran.
This worm was able to get inside of these centrifuge facilities,
and its entire goal was to connect
to a very specific type of centrifuge
and cause that centrifuge to work incorrectly.
This is just one example of a government using an APT
to gain access, and in some cases,
destroy equipment that may be inside of another government
facility.
A Hacktivist is a threat actor that is
both a hacker and an activist.
This is a hacker who has a purpose
or goal in performing these threats or attacks
against a third party.
This is commonly associated with a political or social message,
but it doesn't have to be limited
to those particular areas.
These attacks can be very sophisticated,
and they're very focused on a single message
or a single theme.
It may be that the hacker is trying
to perform a denial of service or deface a website
or find private information that can then
be released to the public.
There's not usually a financial gain to this hacktivism,
so often the hacktivist has to go outside of the organization
to try to raise funds to keep going.
A Script Kiddie is a threat actor who may not necessarily
be a kiddie, but they may be focused
on running very simple scripts to be able to gain access
to someone's network.
The script kiddie is usually someone
who's on the outside who's trying to gain access
to internal resources.
But they just don't have the knowledge or experience
to know exactly what to do to gain that access.
We often call them a script kiddie,
because what they're doing is simply
throwing a lot of different scripts
and a lot of different attacks at a system.
And they're hoping that one of them is going to find a way in.
Even though they don't know exactly how these scripts work,
they're hoping that one of them is going to give them
the access they need.
This is also a threat actor who doesn't necessarily
have a financial gain as the result of this,
so often there are limited resources
for the script kiddie.
But they're motivated by the process itself.
They're looking to brag that they gained access
to someone's network or they were
able to exfiltrate some data.
Organized crime is a threat actor that certainly transcends
computers, but they certainly have made a name
in information technology.
This is a set of professional criminals.
This is what they do for a living,
and they are almost always motivated by a financial gain.
Because there's usually significant financial benefit
to these types of hacks, there's usually enough money
to purchase the best hackers.
And this group may be structured just like any other business.
There may be someone who's hacking,
another person managing the exploits that they use,
another person selling the data that is gathered from all
of these efforts, and someone else handling,
for example, customer support.
From the outside this may look like a normal company,
but of course, this is a threat actor
that has access to a lot of funds
and a lot of resources to be able to keep
these threats going.
The term hacker has a very broad definition,
but it usually refers to an expert with technology.
This may be an expert who's working for good,
or it may be an expert who's being malicious.
There are many ethical hackers.
These are people who are hired to look
at a network try to gain access, find the weak points,
and then help resolve those weak points to make the network even
stronger.
This is usually someone who has permission
to perform these hacking functions because they're
going to help make the entire system much more secure.
The other end of the spectrum is a hacker
who is simply malicious.
They're looking to cause problems.
They're looking to gain access to your data,
and they're looking to cause the most amount of mayhem
as possible.
There are hackers that are in the middle of these two
extremes.
These are semi-authorized hackers
who may be looking for vulnerabilities,
but don't necessarily act on those vulnerabilities.
This is a hacker who is more of a researcher
and trying to find access to someone's network
without necessarily taking advantage of that access.
You may work in an organization that has an IT department,
but you may not be part of that IT department.
And there may be times when you need
to get something done with technology,
but the IT department is not able to do that for you.
So instead of going through the IT professionals
at your organization, you would instead
start creating your own separate IT entity.
This would be the shadow it of your organization.
This is a case where you're performing
your own it functions without interacting
with your internal information technology department.
People who don't work in IT often
don't understand some of the restrictions and the policies
that are in place.
They feel that those types of policies
are roadblocks that restrict them from doing their job.
So to work around these restrictions,
they might create their own Cloud Infrastructure,
they might purchase their own equipment.
But they're doing this outside the purview of the IT processes
and procedures.
Although there may be some short-term benefits that
would allow an organization to move very quickly without being
encumbered, they are very often significant disadvantages
for being a shadow IT group.
For example, you've probably wasted time and money
because IT department can do things usually faster and less
expensive.
There are also security risks associated with this.
And if you're not an expert in it security,
you may be creating risks that you had no idea even existed.
Of course, there can be significant compliance issues.
And depending on your organization
and where your organization might be,
there might be some significant legal requirements.
And of course internal infighting creates dysfunction.
And that dysfunction usually costs money, efficiency,
and time.
The competitors to your business would love
to see you out of the market.
They might be interested in causing a denial of service
to your company.
They might be performing espionage against you,
or just making your reputation one that is tarnished or harmed
in the industry.
Since this type of threat actor can be a for-profit company,
there are usually significant financial resources
they can apply towards these types of threats.
And you can imagine the disruption
that would occur if a competitor was
to gain access to your network.
They could shut down your organization
while you're having a big event, or maybe they
steal all of your customers' data.
They could also corrupt the manufacturing process
and prevent you from creating any new product.
Or they might take all of your financial information
and use that for their own purposes.