2 Threat Actors and Attribution Free Online FlashCards

What is a threat actor?

A person or group that may intentionally compromise, disrupt, or misuse information systems.

What commonly motivates nation-state actors?

They commonly pursue espionage, strategic advantage, or disruption for geopolitical purposes.

What is the common motivation of cybercriminals?

They generally seek financial gain through fraud, data theft, extortion, or selling access.

What motivates hacktivists?

They act to promote a political or social cause, sometimes seeking attention, embarrassment, or service disruption.

What makes insider activity difficult to detect?

They misuse legitimate access, deliberately or unintentionally; their actions can be hard to distinguish from normal activity.

What may motivate thrill-seekers and inexperienced actors?

They may seek challenge, recognition, or amusement, often using widely available tools.

How may terrorist groups use cyber activity?

They may use cyber activity to support ideological goals, such as propaganda or disruption.

How do capability and resources differ?

Capability is what an actor can do; resources are what the actor can draw on to do it, such as funding, personnel, time, or tools.

How can a low-skill actor still cause cyber harm?

An actor with limited technical skill can still cause harm by exploiting exposed systems, using stolen credentials, or relying on off-the-shelf tools.

What does an advanced persistent threat label establish?

It describes a level or pattern of activity; it does not prove a specific identity or government affiliation.

What is cyber attribution?

Attribution assesses who is responsible by considering technical evidence and context; it is generally an assessment with a confidence level, not automatic certainty.

Why can a tool or technique alone not identify an actor?

Tools and techniques can be shared, copied, or planted, and actors may imitate others in false-flag operations; one clue alone does not identify a perpetrator.