Threats, Vulnerabilities, and Mitigations · Topic 1 of 9
Threat Actors and Motivations
Compare Security+ threat actors such as nation states, hacktivists, organized crime and insiders by resources, skill, location and motivations.
- 4 min
- Actors are compared by location, resources and funding, and sophistication.
- Nation states have the most resources and the longest campaigns. Their typical motive is espionage or disruption.
- Hacktivists act for a cause, not for money.
What it is
A threat actor is a person or group that may harm an organization's systems or data. Security+ asks you to tell actors apart by their attributes and to match each one to the motive that usually drives it.
Three attributes separate them.
Location: internal or external. Resources and funding: how much money and time they can spend. Level of sophistication and capability: how advanced their skills and tools are.
How it works
Types of actors
| Actor | Typical profile | Common motivation |
|---|---|---|
| Nation state | Government backed, highly skilled, large funding, long campaigns | Espionage, war, political advantage, service disruption |
| Unskilled attacker | Uses ready made tools with little understanding | Curiosity, fame, disruption |
| Hacktivist | Group driven by a cause | Philosophical or political beliefs, publicity |
| Insider threat | Employee, contractor or partner with legitimate access | Financial gain, revenge, or by accident |
| Organized crime | Structured group that runs attacks as a business | Financial gain, blackmail |
| Shadow IT | Staff who use unapproved systems or services | Convenience, not malice |
The unskilled attacker was once called a script kiddie. Shadow IT is not a hostile actor, but it creates risk because the security team does not know the systems exist and cannot protect them.
Internal and external
An insider already has access, knowledge of the layout and some trust. This makes insiders hard to detect with controls that only watch the network edge.
An external actor starts without access and must find a way in. Nation states and organized crime are normally external, but they may recruit or pressure an insider.
Resources and sophistication
Resources and skill usually go together but are not the same. A well funded group can buy tools and zero-day exploits, while a lone expert may have skill but limited money. Nation states sit at the top for both, and unskilled attackers sit at the bottom.
Motivations
| Motivation | Meaning |
|---|---|
| Data exfiltration | Stealing data out of the organization |
| Espionage | Gathering secret information for a state or competitor |
| Service disruption | Taking systems offline |
| Blackmail | Threatening to expose information or cause harm |
| Financial gain | Direct profit, as with ransomware or fraud |
| Philosophical or political beliefs | A cause or ideology |
| Ethical | Acting for what the attacker sees as the public good, as in some responsible disclosure |
| Revenge | Anger at a person or employer |
| Disruption or chaos | Causing damage for its own sake |
| War | Attacks as part of a conflict between states |
What to remember for the exam
- Actors are compared by location, resources and funding, and sophistication.
- Nation states have the most resources and the longest campaigns. Their typical motive is espionage or disruption.
- Hacktivists act for a cause, not for money.
- Organized crime acts for money and often uses ransomware or fraud.
- Insider threats can be malicious or accidental, and they have legitimate access.
- Shadow IT is use of unapproved technology and is a risk to visibility.
- An unskilled attacker uses existing tools and has few resources.
- Match the motive in the scenario to the actor: political cause to hacktivist, profit to organized crime, state interest to nation state.
In scenario questions, look for the clue words: "cause" points to hacktivist, "long term access" suggests a nation state, and "ransom" points to organized crime.
Common mistakes
Assuming every insider is malicious. Many insider incidents come from mistakes, such as sending data to the wrong recipient or clicking a bad link.
Treating money as the only motive. Espionage, political belief, revenge and disruption have nothing to do with profit.
Confusing hacktivists with nation states. Both may be political, but a hacktivist is usually a loosely organized group with fewer resources, while a nation state has government backing.
Ignoring shadow IT. It is not an attack, but data on unapproved services is outside the organization's controls.
Assuming skill equals resources. The question may say "well funded" or "highly skilled", and these are separate attributes.
An external actor can become effectively internal by stealing an employee's credentials, so do not rely on location alone to judge risk.
Check yourself
Which threat actor usually has the largest budget and the longest campaigns?
A nation state.
A group defaces a company site to protest its policies. Which actor and motive fits?
A hacktivist acting on philosophical or political beliefs.
Why is shadow IT a security concern?
Staff use systems the security team does not know about, so those systems are not monitored, patched or protected.
Topic 1 of 9 in Threats, Vulnerabilities, and Mitigations
Test yourself on Threats, Vulnerabilities, and Mitigations
The full CompTIA Security+ SY0-701 question bank has 848 questions, with timed practice exams and an explanation for every answer.
This study guide is independent and is not affiliated with, endorsed by, or sponsored by CompTIA. Vendor names, certification names and exam codes are trademarks of their respective owners and are used for identification only.