Threats, Vulnerabilities, and Attacks · Topic 2 of 10
Threat Actors and Motivations
Compare Security+ threat actors such as state-sponsored groups, crime syndicates, hacktivists and insiders by resources, skill, location and motivation.
- 5 min
- Actors are compared by internal or external location, resources and funding, and sophistication.
- State-sponsored actors have the most resources and the longest campaigns. Their typical motives are espionage and political advantage.
- Crime syndicates act for money and often use extortion.
What it is
A threat actor is a person or group that may harm an organization's systems or data. Security+ asks you to tell actors apart by their attributes and to match each one to the motive that usually drives it.
Three attributes separate them: location (internal or external), resources and funding (how much money and time they can spend), and level of sophistication and capability (how advanced their skills and tools are).
How it works
Types of actors
| Actor | Typical profile | Common motivation |
|---|---|---|
| State-sponsored | Government backed, highly skilled, large funding, long campaigns | Espionage, political advantage, influence |
| Crime syndicate or organized crime | Structured group that runs attacks as a business | Financial gain, extortion |
| Terrorist | Group that uses attacks to cause harm and spread fear for a cause | Fear and chaos, ideological or political aims |
| Unskilled attacker | Uses ready made tools with little understanding | Curiosity, notoriety |
| Hacktivist | Group driven by a cause, often public and loosely organized | Ideological or political beliefs, publicity |
| Insider | Employee, contractor or partner with legitimate access who acts on purpose | Revenge, financial gain |
| Accidental or unintentional | Staff member who causes harm by mistake | None, it is an error |
| Competitor | Rival company seeking an advantage | Intellectual property, espionage |
The unskilled attacker was once called a script kiddie. A state-sponsored group that keeps long term hidden access is often called an advanced persistent threat (APT).
Internal and external
An insider already has access, knowledge of the layout and some trust. This makes insiders hard to detect with controls that only watch the network edge.
An accidental insider is still a threat even with no bad intent. Sending a file to the wrong person or misconfiguring a server can cause a breach as serious as an attack.
An external actor starts without access and must find a way in. State-sponsored groups, crime syndicates and competitors are normally external, but they may recruit, bribe or pressure an insider.
Resources and sophistication
Resources and skill usually go together but are not the same. A well funded group can buy tools and zero-day exploits, while a lone expert may have skill but limited money.
State-sponsored actors sit at the top for both. Unskilled attackers sit at the bottom, and crime syndicates are often well funded because attacks earn them money.
Motivations
| Motivation | Meaning |
|---|---|
| Financial | Direct profit, as with fraud or selling stolen data |
| Extortion | Demanding payment under threat, as with ransomware or a threat to leak data |
| Espionage | Gathering secret information for a state or business |
| Intellectual property | Stealing designs, code or trade secrets |
| Influence | Shaping opinion or decisions, for example around an election |
| Political | Advancing a political goal or punishing an opponent |
| Ideological | Acting on a belief system or cause |
| Notoriety | Seeking fame or reputation |
| Fear or chaos | Causing disruption and alarm for its own sake |
| Revenge | Anger at a person or employer |
| General curiosity | Wanting to see whether something can be done |
| Ethical | Acting for what the attacker sees as the public good, such as exposing a flaw |
Influence, political and ideological motives overlap, so read the scenario carefully. Influence is about changing what people think or do, political is about a government or party goal, and ideological is about a belief system.
What to remember for the exam
- Actors are compared by internal or external location, resources and funding, and sophistication.
- State-sponsored actors have the most resources and the longest campaigns. Their typical motives are espionage and political advantage.
- Crime syndicates act for money and often use extortion.
- Terrorists aim to cause fear and chaos for a cause.
- Hacktivists act for ideological or political reasons, not for money.
- Insiders have legitimate access. Accidental insiders cause harm without meaning to.
- Competitors want intellectual property and business secrets.
- An unskilled attacker uses existing tools, has few resources and often seeks notoriety or acts from curiosity.
In scenario questions, look for clue words: "cause" points to a hacktivist, "long term hidden access" to a state-sponsored group, "ransom" to a crime syndicate and "rival firm" to a competitor.
Common mistakes
Assuming every insider is malicious. Many insider incidents are accidental, such as sending data to the wrong recipient or clicking a bad link.
Treating money as the only motive. Espionage, influence, revenge, notoriety and chaos have nothing to do with profit.
Confusing hacktivists with state-sponsored actors. Both may be political. A hacktivist group usually has fewer resources and wants publicity, while a state-sponsored group has government backing and wants to stay hidden.
Mixing up financial and extortion. Extortion is a threat followed by a demand. Plain financial motive includes fraud and theft with no threat made.
Assuming skill equals resources. The question may say "well funded" or "highly skilled", and these are separate attributes.
An external actor can become effectively internal by stealing an employee's credentials, so do not rely on location alone to judge risk.
Check yourself
Which threat actor usually has the largest budget and the longest campaigns?
A state-sponsored actor.
A rival company pays someone to copy a firm's product designs. Which actor and motive fit?
A competitor motivated by intellectual property theft.
An employee emails a customer list to the wrong address by mistake. Which kind of threat actor is this?
An accidental or unintentional insider.
Topic 2 of 10 in Threats, Vulnerabilities, and Attacks
Test yourself on Threats, Vulnerabilities, and Attacks
The full CompTIA Security+ SY0-801 question bank has 998 questions, with timed practice exams and an explanation for every answer.
This study guide is independent and is not affiliated with, endorsed by, or sponsored by CompTIA. Vendor names, certification names and exam codes are trademarks of their respective owners and are used for identification only.