If you've seen my videos on this channel, you know I talk about cybersecurity and make a lot of references to "the bad guys".
Who are these folks?
What do they do?
Why do they do it?
Let's peel back the layers and get a better understanding.
This guy, [General] Sun Tzu, wrote a book about 2500 years ago called "The Art of War".
And in that he said, "If you know the enemy and know yourself, you need not fear the result of a hundred battles".
To shorten that, it's basically "know your enemy".
Well, who is the enemy?
Well, we use a lot of different kinds of terms to describe these folks.
And to be honest with you, there's some debate as to what the definition should be.
So I'm going to tell you what I'm going to define it as in this context.
When I use the term "hacker", I'm referring to-- not
--for instance, a geek who's really great at a hackathon and can win that contest --really has a lot of technical skills.
I'm also not referring to a really bad golfer, because that's another definition of the term hacker.
I'm referring to a bad guy.
Now, again, there is some disagreement as to whether that's how the term should be used.
Because there are a lot of people who are on the good side of computer security that also use that term to apply to themselves.
So apologies to those who want a different definition.
I'm going to go with what Google says, since that's one of the most common things that I think people would understand.
And that is, "a person who uses computers to gain unauthorized access to data".
So what about these folks?
If Sun Tzu said, "we need to know our enemy", what do we need to know about these guys?
Well, it turns out they're not all the same.
We can't paint them with a single broad brush and really have a good understanding of what they do.
So let's talk about the different types of hackers that we might have--
the different types of adversaries, if you choose that term and prefer that instead.
Well, we can think of them along a number of different dimensions.
Think of this as a taxonomy or classification system.
And this first one, I'm just going to refer to as the hat that they wear.
You could have "black hat" hackers and "white hat" hackers.
And then even someone in between, the "gray hats".
So the difference between a white hat hacker and a black hat is really simple: It's consent.
A black hat does not have permission to break into your system; a white hat does.
A white hat hacker would be someone who is under contract.
You've hired them to do a penetration test and see if they can get into your system, and they are following certain rules.
The black hat [hacker] is doing it for different reasons.
And then a gray hat [hacker] is someone who may not have permission, but they think they're doing something good.
So they're in that gray area.
So that's one way of classifying the people that are trying to break into systems.
Another is their skill type.
I think many times we assume that all hackers are super-skilled; and in fact, they're not.
In fact, we have "script kiddies" that are on one end of the spectrum-- who are just downloading code and running it.
And then we have the elite hackers, and everything, again, in between.
So that's another way of looking at what is an adversary, and it's based upon their skill abilities.
Another thing is TTPs: This is tactics, techniques and procedures.
So in other words, what are they doing when they do it?
What kinds of tools do they use and what are their ultimate objectives?
So there could be crackers: Those are people that are trying to break into cryptography.
There could be malware writers.
There could be denial of service attackers.
There are pen testers--penetration testers.
So they're using different kinds of tools to do that, doing vulnerability scans and things like that.
Social engineers are another one that are not really hacking the systems.
They're kind of hacking the people.
They're basically doing a con game on the individuals in order to get into a system.
Another way to look at these attackers would be motive.
What's the reason that they're doing what they're doing?
Well, there could be a number of motives, for instance, piracy.
I want to get a movie and make copies of it so all my friends can can watch the movie and not pay for it.
There could be a profit.
That is, I'm wanting to make money from my activities.
Or there could be politics.
So any one of those three Ps-- piracy, profit and politics --could be the reason that we're doing this.
Another motivation or another-- actually classification --that we could look at would be targets.
So what is this person going after?
The target might be a bank, it might be a nation state, it might be individuals.
So it could be any of those as well.
And again, the way we look at the way they attack would be different
depending on which one of those things they're going after.
And then a much more controversial one would be the psychology of the attacker.
So we've got a range here as well.
This could be someone who is a sociopath, it could be a misfit, it could be a criminal.
So there's a lot of different elements here also to consider.
So this is showing you, I hope, that there's a much more complex definition as to what an attacker would look like.
The things that are motivating them, the things they're doing and why they're doing it.
So here is a different way.
That's a very complex view that we would have to do a multidimensional matrix in order to map all of that out.
I'm going to try to give you a more simple taxonomy that I think captures most of these aspects.
It's not perfect.
Nothing is going to capture all of these.
But this is one that we can at least consider as a more simple version.
So we've got different types of hackers.
And I'm going to say Roger Grimes writing an article for Infoworld.com
came up with this, and then I'm going to add a few to it.
The work that he did, I think is really solid, so that's why I'm citing it.
So we've got criminals.
These are the ones who are breaking in for a lot of the kinds of reasons that we've talked about--that's one type of hacker.
We've got spammers.
So this is a different kind of attack.
The spammer is doing much more of just overloading the system, or overloading the person's mind and trying to con them in.
This is a little more of social engineering, if you think of it that way.
We've got things that are called APTs: advanced persistent threats.
This is usually the work of nation states and
departments of defense and things like that, where they are using really advanced capabilities.
They're looking for zero days.
A zero day is something where there's a vulnerability in the software for which there is no patch,
so no one has a good protection against it right away.
So this is very elite kind of stuff.
Then we have corporate spies.
These are people that are motivated by profit.
They're trying to steal corporate secrets, intellectual property from some organization in order to use it in their organization.
Then we have hacktivists.
What's a hacktivist?
Well, hacktivist is someone who's hacking for a cause.
This is basically a political or social statement that they're trying to make.
They disagree with what a given organization is doing,
so they're going to attack that website in order to let their displeasure be known.
This could take the form of basically e-graffiti where I'm marking up their website.
Or it could be denial of service where I'm taking their website down, to try to make a point.
Others could be cyber warriors.
These are basically fighters who fight not on the battlefield, but their battlefield is in cyberspace.
And we see more and more the rise of the cyber warrior as militaries become more and more modern.
It's an asymmetric threat, meaning any organization, any country, with a computer can have a cyber warfare capability.
So the barrier to entry is very low.
Then we have rogue hackers.
These are people who operate sort of outside of all of these other constraints.
They really defy definition in many cases, and their motivations are not always clear-- at least not obvious to us in every case.
So this was the work that I mentioned earlier.
I'm going to add a couple more categories here.
And that is the accidental hacker.
The one who maybe is in your organization, who doesn't mean ill, doesn't have any malicious intent, but they misconfigured a system.
So now it ends up taking the system down,
or they have malware installed on their system that they didn't realize,
and now they are basically the source of an attack on the organization.
So an accidental-- even though their intentions might not be bad --their actions and the effects can be the same.
And then the last category I'm going to mention is one that is rising more and more.
And this is the cyber stalker.
This is someone who puts some sort of malware, some sort of spyware, on maybe your phone, your computer, your tablet.
And then they're able to look at all your activities.
Everywhere you go, they follow and see the GPS location.
They can read your emails, your text messages, turn on the camera,
turn on the microphone on your device, and listen to your conversations.
This is a substantial threat.
So hopefully you can see from all of these there are a lot of different reasons why adversaries try to break into systems.
So when I talk about the "bad guys", I want us to have a better understanding of what those bad guys are.
Hopefully now you have a better understanding.
This is a much more complex, much more nuanced subject than a lot of people would realize.
So take some of your stereotypes and throw them away,
and start thinking about more the complexity of what this space really looks like.
And just remember, if you're satisfied with your security, so are the bad guys.
That means we need to follow the advice of Sun Tzu.
We need to know our enemy so that we can fight the bad guys.
Thanks for watching.
If you found this video interesting and would like to learn more about cybersecurity, please remember to hit Like and Subscribe to this channel.