Talib AliCybersecurity Study Guide & Portfolio

Study Guide

Threat Actor Types, Attributes and Motivations

Who attacks, why they do it and how they differ: the main types of threat actor, the attributes used to compare them, intent and motivation, insider threats, Shadow IT, and the difference between a vulnerability, a threat and a risk.

Lesson 2.6 Threats, Vulnerabilities & Defence

Security conversations are full of words that sound alike: threat, threat actor, vulnerability, risk, attack vector, attack surface. This lesson untangles them, and then uses them to compare the people and groups who carry out attacks. It builds on Threat Actors, which introduced motivation, capability and opportunity.

Think

Taking a report apart

A news report says: “A criminal gang, after money, got into a hospital’s systems using a member of staff’s stolen password on its remote-access page, which asked for nothing else.”

Think it through

Take the report apart. Which words answer who? Why? How? And where?

Show what happens

Who: a criminal gang. Why: money. How: a stolen password. Where: the remote-access page. Four different questions, and each one turns out to need a different word, and a different kind of defence.

Think it through

Which of the four could the hospital most directly change?
Show the answer

Answer: C. Where and how: what can be reached, and how it is protected.

The hospital cannot change who attacks it or why. It can change where an attacker could get in, and how well each way in is protected or watched.

Explain

Four questions that keep the ideas apart

Those four questions can take apart almost every description of an attack. Each has its own term.

Who, why, how and where

Who?Threat actor
The person or group that could cause harm.Example: an organised crime group.
Why?Intent or motivation
What they want and what drives them.Example: money, obtained by extortion.
How?Attack vector
The route or method they use to get in.Example: a phishing email that steals a password.
Where?Attack surface
The points they could reach or interact with.Example: staff mailboxes, the remote-access portal, the public website.

If a sentence about an attack is unclear, ask which of the four questions it is answering.

Why it matters. Each question leads to a different kind of defence. You cannot change who wants to attack you, or why. You can reduce where they could get in, and you can block or detect how they try.

The four questions sit inside a longer chain that runs from the actor to the harm:

From threat actor to impact: one fictional attack, step by step

An original diagram. Each step answers one question. The organisation and the attack are fictional.

  1. Threat actor (who)

    An organised crime group.

  2. Motivation (why)

    Financial gain, through extortion.

  3. Attack vector (how)

    Stolen credentials used at the remote-access (VPN) portal.

  4. Attack surface (where)

    The internet-facing VPN portal, one of several points the group could have tried.

  5. Vulnerability (the weakness)

    The portal accepts a password alone, with no multi-factor authentication.

  6. Impact (the harm)

    Unauthorised remote access, followed by data theft and disruption.

Read it as one sentence: an organised crime group, wanting money, uses stolen credentials at the VPN portal, which has no second factor, and gains access that harms the organisation. (A VPN, or virtual private network, lets staff connect to the organisation’s network from outside; the portal is its sign-in page.) Attack Surfaces and Attack Vectors takes the “how” and “where” further.

Predict

Vulnerability, threat and risk

Think it through

An office’s back door has a broken lock, and burglars are known to be working in the area. Which of these is the risk?
Show the answer

Answer: B. That someone gets in and steals equipment.

The broken lock is the weakness, the burglars are the danger, and the risk is the harm that could follow if the two meet. The words for each come next.

These three words are the most commonly mixed up, so take them one at a time.

  • A vulnerability is a weakness. It might be in software, in a configuration, in a process or in how people behave.
  • A threat is a potential danger that is capable of exploiting a weakness. A threat is something that could happen. The threat actor is the “who” behind it.
  • A risk is the potential harm that results if the threat exploits the vulnerability.

The relationship between them is a sentence, not a sum:

A threat exploiting a vulnerability creates risk.

A second, separate statement says how large a risk is:

Risk level ≈ likelihood × impact

Likelihood is how probable the harm is; impact is how bad it would be. A risk that is very unlikely and minor is low. A risk that is likely and serious is high.

A fictional company lets staff connect from home through a virtual private network (VPN). Signing in needs only a username and password.

  1. Vulnerability: the VPN has no multi-factor authentication (MFA), so a password alone is enough.
  2. Threat: an attacker who has obtained a member of staff’s credentials.
  3. Risk: unauthorised remote access to the company’s internal systems.
  4. Level of risk: judged from likelihood and impact. Stolen passwords are common, so the likelihood is high; the VPN reaches internal systems, so the impact is serious. The level is high.

If the company turns on MFA, the weakness is reduced and the likelihood falls. The threat has not gone away: attackers with stolen passwords still exist. That is why fixing a vulnerability lowers a risk without removing the threat.

Vulnerability, threat and risk

Vulnerability
A weakness.A VPN with no MFA.
Threat
A potential danger capable of exploiting a weakness.An attacker with stolen credentials.
Risk
The potential harm if the threat exploits the vulnerability. Its level is judged from likelihood and impact.Unauthorised remote access.

It is tempting to run both statements into one formula. They answer different questions. The first says how a risk arises: a threat meets a weakness. The second says how big the risk is: likelihood and impact together. Neither is arithmetic, and a vulnerability cannot be “added” to a threat. Risk explains why these expressions are models and not calculations.

Predict

The main types of threat actor

A threat actor is the “who”. Actors are usually grouped into types, because a type suggests what the actor is likely to want and how capable it is likely to be. A type is a starting point for thinking, not proof of anything about a particular attacker.

Think it through

Before the table: what do you think each of these usually wants? A government’s spy agency; a criminal gang; a protest group; an employee with a grudge; a rival company.

Show what happens

Compare your answers with the table: espionage or advantage, money, attention for a cause, gain or revenge, and commercial advantage. The table adds how capable each usually is.

Six types compared

TypeWho they areWhat usually drives themCapability and resources
Nation-statePart of a government, or sponsored by one.Espionage, strategic advantage, disruption, influence.Often very high, with substantial funding.
Organised crimeCriminal groups run like businesses.Money: fraud, ransomware, extortion, stolen data.Varies; can be sophisticated and highly structured.
HacktivistPeople or groups promoting a cause.Ideology or politics: attention, protest, disruption.Varies widely.
InsiderSomeone with legitimate, trusted access.Gain, revenge or pressure, if malicious; none at all, if the harm is accidental.Limited by the access they hold, but they are already inside.
Unskilled attackerAn individual with little technical skill.Curiosity, bragging rights, opportunity.Low; relies on tools written by others.
CompetitorA rival organisation.Commercial advantage.Varies; may act through insiders or hired help.

Nation-state actors are examined in Nation-State Actors, APTs and MITRE ATT&CK. The others are described below.

Unskilled attackers

An unskilled attacker commonly:

  • has limited technical capability;
  • uses ready-made tools and scripts written by other people;
  • goes after easy opportunities, not a carefully chosen victim;
  • has few resources.

As an analogy only, think of a shoplifter: opportunistic, taking what is easy to reach and relying on what is already to hand. The analogy is about opportunism and limited means. It is not a formal definition.

“Unskilled attacker” is the current name for this type. You may still see the older, informal term “script kiddie”. Do not dismiss the type: a ready-made tool pointed at an unpatched, exposed system can do real damage.

Organised crime and competitors

Organised crime groups are driven mainly by financial gain. Their methods include fraud, ransomware, extortion, stealing credentials and selling stolen data. Do not confuse “criminal” with “crude”: organised cybercrime can be sophisticated, with specialists, managers and something close to customer support. A useful analogy is a coordinated heist crew of the kind shown in films such as Ocean’s Eight, where each member has a role. Again, that is an analogy for coordination, not a description of how any real group works.

Competitors are driven mainly by commercial advantage. What they want is information that helps them compete: intellectual property, trade secrets, research, product plans, pricing and strategy.

A quick way to tell the two apart:

  • organised crime: usually money first;
  • competitor: usually business advantage first.

The two overlap. Stolen designs can be sold, and a rival might pay criminals to obtain them.

Check your understanding

Designs for a new phone are stolen and turn up at a rival manufacturer. Nobody was paid for them. Which actor type is the more likely?
Show the answer

Answer: B. A competitor: the gain is advantage.

A competitor: the designs bring commercial advantage, and nothing was sold. If they had been sold on, organised crime would be the likelier story.

Hacktivists

A hacktivist attacks to advance a political or social cause. Typical aims are attention and disruption: defacing a website, leaking documents or taking a service offline. Skill varies from very little to a great deal.

Predict

Shadow IT is a risk, not an actor

Think it through

A team starts planning its rota in a free online spreadsheet tool, without asking IT, because the official system is clumsy. Is the team a threat actor?
Show the answer

Answer: C. No: nobody means harm, but they have created risk.

Nobody intends harm, so nobody here is an attacker. But the data now sits in an unmanaged tool, which adds risk. That situation has a name.

Shadow IT is technology, software or online services that people use for work without the organisation’s approval or management.

An employee needs to send large files to a client. The approved corporate process is slow and awkward, so the employee uploads the files to a personal cloud-storage account and shares a link.

Nobody here wants to cause harm. The employee is trying to get the job done. Even so, the organisation now has:

  • unmanaged data: company files in a place it cannot see, back up or delete;
  • weak access control: access depends on one person’s personal password and sharing settings;
  • compliance problems: personal or contractual data may be stored where it must not be;
  • reduced visibility: the security team cannot monitor or protect a service it does not know exists.

Shadow IT is sometimes listed alongside threat actors. Strictly, it is not a “who”. It is a situation: unauthorised or unmanaged technology that adds to the organisation’s risk and enlarges its attack surface. The people involved are usually well-meaning insiders, not attackers.

Because it usually comes from people trying to work, the lasting answer is not only to forbid it. It is to provide approved alternatives that are easy to use, explain why they matter, and find out which unofficial tools people have turned to and why.

Explain

Attributes used to compare actors

Three attributes describe an actor. Two further ideas describe how defenders study actors.

Attributes of the actor

AttributeThe questionThe range
SourceWhere does the actor stand in relation to the organisation?Internal (already has trusted access) or external (must first get in).
Sophistication and capabilityHow skilled is the actor, and what can it do?From ready-made tools to custom tools and long, multi-stage operations.
Resources and fundingHow much money, time and people can it spend?From one person’s spare time to a funded team working for years.

Threat knowledge and adversary behaviour

Think it through

Before reading on: “threat knowledge” and “adversary behaviour”. Which do you think describes the defenders, and which the attackers?

Show what happens

Threat knowledge is what defenders know; adversary behaviour is what attackers do. Defenders build the first by studying the second.

These two phrases are easy to read the wrong way round.

  • Threat knowledge is what defenders know about threats: known actors, their tactics and techniques, known vulnerabilities, indicators of compromise (signs that a system has been breached, such as a file or address linked to an attack) and current or emerging threats.
  • Adversary behaviour is what attackers actually do and how they operate.

In professional use, threat knowledge that has been collected, analysed and shared is usually called threat intelligence, or cyber threat intelligence (CTI).

Good threat knowledge is built by studying adversary behaviour. MITRE ATT&CK is a public example of exactly that.

Predict

Intent, objectives and drivers

“Why did they attack?” is really three questions, and it helps to answer them separately.

  1. The underlying driver: the deeper reason. Examples: financial gain, fraud, extortion, blackmail, ideology, political objectives, revenge, competitive advantage.
  2. The strategic objective: what the actor is trying to achieve in this operation. Examples: service disruption, data exfiltration, disinformation, espionage, strategic advantage.
  3. The intent: whether harm was meant at all, and how the victim came to be chosen.

Put together, they form a chain:

Underlying driver → strategic objective → intent → target and behaviour

For example: financial gain (driver) leads a group to aim for data exfiltration (objective); it acts maliciously and against a chosen victim (intent), and so it picks a company that holds valuable records and goes after them (target and behaviour).

Two different scales of intent

Think it through

A protest group defaces the website of one particular oil company it opposes. Was the victim chosen, and was harm meant?
Show the answer

Answer: B. Chosen and meant: targeted and malicious.

Both: they chose this company (targeted) and intended the harm (malicious). Those are two separate scales, as the panel below shows.

Three words describe intent: maliciously targeted, opportunistic and accidental (unintentional). They mix two different scales, and separating the scales removes most of the confusion.

How the victim was chosen, and whether harm was meant

Chosen?Targeted or opportunistic
How deliberately the victim was selected. Targeted: this victim was picked. Opportunistic: whoever happened to be vulnerable.
Meant?Malicious or unintentional
Whether harm was intended. Malicious: yes. Unintentional (accidental): no.

An opportunistic attack can still be malicious. A criminal who scans the internet for any unpatched system has not chosen a victim, but fully intends harm.

Two cautions about labels:

  • “Nation-state” is an actor type, not a motivation. A state’s motivations are things such as espionage or strategic advantage.
  • “Malicious” and “opportunistic” are not actor types either. They describe intent and targeting. An insider can be malicious; an unskilled attacker is usually opportunistic.

A third caution concerns people, not labels. Someone who discloses information without authorisation, for example a whistleblower, is not automatically a malicious threat actor. The disclosure may still represent an insider or data-loss risk that the organisation must manage, while the person’s own stated motives may be quite different. Describe what happened before judging why.

Predict

Insider threats

An insider is someone with legitimate, trusted access: an employee, a contractor, a temporary worker or a partner with an account. The insider threat is the possibility of harm coming from that access.

Think it through

When insiders cause security harm, is it more often deliberate or accidental?
Show the answer

Answer: C. Accidental: mistakes are more common than malice.

Mistakes are generally more common, and they are handled differently from malice: clearer processes, safer defaults and a culture of reporting.

Malicious insiders

A malicious insider intentionally abuses legitimate access. Fictional examples:

  • an employee copies customer data to sell;
  • an administrator creates a hidden account before leaving, to keep a way back in;
  • a member of staff sells intellectual property.

Unintentional insiders

An unintentional insider causes security harm without meaning to. Fictional examples:

  • sending sensitive data to the wrong recipient;
  • clicking a link in a phishing email;
  • misconfiguring permissions so that a folder is open to everyone;
  • losing a laptop that was not encrypted.

Published breach studies generally find unintentional harm more common than malicious harm, and it is addressed differently: clearer processes, safer defaults, training and a culture in which mistakes are reported quickly.

Internal is not the same as malicious

SourceInternal or external
The actor’s origin and trust relationship: do they already hold authorised access?
IntentMalicious or unintentional
Whether they meant to cause harm.

“Insider” says where the person stands. It says nothing about what they intended.

Contractors and working from home

Two points often cause mistakes.

  • A contractor can be both. As a third-party worker, a contractor is external to the organisation. Once given trusted, authorised access, the same contractor presents insider-like risk. What matters is the access, not the employment contract.
  • Location does not decide it. An employee working from home is still an insider. Being physically outside the building does not make the risk external, and sitting inside the building does not make a visitor an insider.

An employee who leaves for a rival (fictional)

A design engineer at a fictional manufacturer accepts a job with a competitor. Before leaving, the engineer downloads thousands of technical files from the company’s design repository.

  • The direct threat actor is the insider. The engineer performed the action, using legitimate access.
  • The competitor is part of the context. It may benefit, and corporate espionage may be the wider story, but it did not carry out the download.
  • “Malicious” describes the intent. Taking the files deliberately, to use elsewhere, is malicious.
  • “Targeted” describes the selection. Specific, valuable files were chosen.

Neither “malicious” nor “targeted” names the actor. The actor type is insider.

Predict

Leadership and security culture

Think it through

In an organisation whose leaders ignore the security rules themselves, why might everyone else take the rules less seriously?

Show what happens

Staff take their cue from what leaders do, fund and enforce. Where leaders give security little support, the effects show up across the organisation, as listed below.

Security culture tends to reflect leadership priorities. Where leaders treat security as important, fund it and follow the rules themselves, the rest of the organisation usually does too. Where governance is weak and leaders give security little support, risk rises across the whole organisation. The likely consequences are:

  • inadequate resourcing: too few people and too little budget;
  • weak policies: rules that are missing, vague or out of date;
  • poor training: staff who do not know what is expected;
  • ignored risk: known problems left unaddressed;
  • inconsistent enforcement: rules applied to some people and not others.

This is why an insider’s mistake is rarely only the individual’s failing. Security Roles and Responsibilities explains who is accountable for setting that direction.

Explain

Security+ terminology

The CompTIA Security+ SY0-701 exam objectives (objective 2.1, on threat actors and motivations) use the following wording. It is worth recognising, because it does not always match everyday usage.

  • Threat actors listed: nation-state, unskilled attacker, hacktivist, insider threat, organised crime (spelt “organized” in the objectives) and Shadow IT. The objectives place Shadow IT in this list, so expect to see it grouped with threat actors. The reasoning in this lesson still holds: it is unapproved technology introduced by insiders, usually without malice.
  • Competitor is not in that list, although it is a recognised actor type and appeared in earlier versions of the syllabus.
  • Attributes of actors: internal or external; resources and funding; level of sophistication and capability.
  • Motivations listed: data exfiltration, espionage, service disruption, blackmail, financial gain, philosophical or political beliefs, ethical, revenge, disruption or chaos, and war.

Apply

Apply it in a new situation

These questions use the lesson in situations it has not shown. For the strongest test of your understanding, come back to them on another day and answer each one at the first attempt.

Apply it

A school caretaker, who has keys and a staff account, deletes a shared folder by mistake while tidying up files. How would you describe the source and the intent?
Show the answer

Answer: A. Internal and unintentional.

Internal, because the caretaker holds trusted access; unintentional, because no harm was meant. Source and intent are separate questions.

Apply it

A report says: “The attack was motivated by a nation-state.” What is wrong with the wording?
Show the answer

Answer: C. It names an actor type, not a motive.

A nation-state is who acts. A motivation would be something such as espionage, disruption or strategic advantage.

Check

Check your understanding

These questions come from the approved revision bank. They were approved under the site’s approval workflow, which includes owner-authorised delegated review: not every question was read individually by the site owner.

Who, why, how and where

  1. An organised crime group sends phishing emails to a company’s staff in order to steal money. Which part of that description is the attack vector?

    Show answer

    Answer: The phishing emails

    Four separate questions apply. Who is the threat actor: here, the organised crime group. Why is the motivation: stealing money. How is the attack vector: the phishing emails, which are the route used to reach the victims. Where is the attack surface: the staff mailboxes, which are points the attackers could reach. The vector is the route or method, so it is the emails.

    Revision sources: Threat Actor Types, Attributes and Motivations (Supplementary Study Guide explanation)

  2. An employee at a fictional firm finds the approved file-sharing process slow, so they upload client files to a personal cloud-storage account. How is this best described?

    Show answer

    Answer: Shadow IT: unapproved technology that creates unmanaged risk without malicious intent

    Shadow IT is often listed alongside the threat actor categories, but it is unauthorised or unmanaged technology used for work, usually by staff who are trying to get their jobs done. Nothing here suggests an intention to cause harm, so this is not a malicious insider, a hacktivist or an attacker of any kind. It is still a risk: the files now sit where the firm cannot manage, monitor or protect them.

    Revision sources: Session 8: Threat Actors, Attack Surfaces and Social Engineering (Classroom session record) · Threat Actor Types, Attributes and Motivations (Supplementary Study Guide explanation)

  3. Which set of pairings matches each threat actor type with the driver most typical of it?

    Show answer

    Answer: Organised crime: financial gain. Hacktivist: a political or social cause. Competitor: commercial advantage.

    Each type has a typical driver: organised crime is usually after money, through fraud, ransomware or extortion; a hacktivist acts for a political or social cause; and a competitor wants commercial advantage, such as trade secrets or product plans. These are typical drivers, not rules, and motives overlap: stolen designs can be sold, and a rival might pay criminals to obtain them.

    Revision sources: Threat Actor Types, Attributes and Motivations (Supplementary Study Guide explanation)

  4. A member of staff at a fictional charity attaches the wrong file and emails a list of donors to an outside address by mistake. Which description fits?

    Show answer

    Answer: Internal source, unintentional

    Source and intent are two separate questions. The source is internal, because the member of staff holds legitimate, trusted access. The intent is unintentional, because the email was a mistake and no harm was meant. Calling it malicious would claim an intent the facts do not show, and calling it external would ignore that the person acted with their own authorised access. Opportunistic describes how a victim was chosen, which does not apply to an accident.

    Revision sources: Threat Actor Types, Attributes and Motivations (Supplementary Study Guide explanation)

  5. An attack described as opportunistic was carried out without malicious intent.

    Show answer

    Answer: False

    False. Targeted or opportunistic describes how deliberately the victim was selected, while malicious or unintentional describes intent. They are separate scales. A criminal who scans the internet for unpatched systems and attacks whichever one responds has not chosen a particular victim, so the attack is opportunistic, but the criminal fully intends harm, so it is also malicious.

    Revision sources: Threat Actor Types, Attributes and Motivations (Supplementary Study Guide explanation)

  6. A security team keeps its own record of the groups known to target its sector, the techniques those groups use and the indicators of compromise linked to them. Which term names what the team holds, as opposed to what the attackers do?

    Show answer

    Answer: Threat knowledge

    Threat knowledge is the defender’s understanding of threats, covering known actors, their tactics and techniques, vulnerabilities and indicators of compromise. The record is the defenders’ knowledge, so it is threat knowledge. Adversary behaviour is what attackers actually do, which the record describes but is not itself. An attack surface is a set of reachable points, and sophistication is an attribute of an actor.

    Revision sources: Session 8: Threat Actors, Attack Surfaces and Social Engineering (Classroom session record) · Threat Actor Types, Attributes and Motivations (Supplementary Study Guide explanation)

  7. A contractor working from home has been given administrator access to a fictional company’s systems and uses it to copy data they have no reason to see. Why is this an insider risk?

    Show answer

    Answer: Because the contractor holds trusted, authorised access to the systems

    Insider risk comes from trusted, authorised access, not from the employment contract or the place of work. A contractor is external as a third-party worker, yet presents insider risk once given that access. Working from home does not make the risk external, and being employed elsewhere does not remove it. The method used says nothing about who the actor is.

    Revision sources: Threat Actor Types, Attributes and Motivations (Supplementary Study Guide explanation)

  8. Which of these are attributes used to compare threat actors? Select all that apply.

    Show answer

    Answer: Whether the actor is internal or external; The actor’s resources and funding; The actor’s level of sophistication and capability

    Threat actors are compared by their attributes: the source, meaning internal or external; sophistication and capability; and resources and funding. All three describe the actor. The victim’s firewall and password length describe the victim’s own defences. They affect whether an attack succeeds, but they are not attributes of the actor, so they say nothing about who is attacking or what that actor is able to do.

    Revision sources: Session 8: Threat Actors, Attack Surfaces and Social Engineering (Classroom session record)

  9. An engineer at a fictional manufacturer downloads thousands of design files shortly before joining a rival company. Who is the direct threat actor?

    Show answer

    Answer: The engineer, as a malicious insider

    When an employee takes files to a rival, the direct actor is the insider: the engineer performed the download, using legitimate access. The rival may benefit and is part of the competitive context, but it did not carry out the action. Malicious describes the engineer’s intent and is not an actor type by itself, which is why the full answer names the insider. Nothing suggests limited skill or a political cause.

    Revision sources: Threat Actor Types, Attributes and Motivations (Supplementary Study Guide explanation)

Questions on vulnerability, threat and risk

  1. A fictional company’s VPN accepts a username and password with no multi-factor authentication. An attacker has obtained a member of staff’s credentials. Which of these is the vulnerability?

    Show answer

    Answer: The VPN accepting a password without a second factor

    The vulnerability is the weakness: the VPN has no multi-factor authentication, so a password alone is enough. The attacker with stolen credentials is the threat, the potential danger capable of exploiting that weakness. Unauthorised remote access is the risk, the potential harm. Likelihood is one of the two things used to judge how large the risk is, and is not the weakness itself.

    Revision sources: Threat Actor Types, Attributes and Motivations (Supplementary Study Guide explanation)

  2. Which statement correctly relates a threat, a vulnerability and a risk?

    Show answer

    Answer: A threat exploiting a vulnerability creates risk.

    The relationship can be stated as a sentence: a threat exploiting a vulnerability creates risk. A vulnerability is a weakness and cannot exploit anything. A risk is the potential harm that results, so it comes last and does not create the weakness. The relationship is not arithmetic, so nothing is added to give a vulnerability.

    Revision sources: Session 8: Threat Actors, Attack Surfaces and Social Engineering (Classroom session record) · Threat Actor Types, Attributes and Motivations (Supplementary Study Guide explanation)

  3. The level of a risk is judged from its likelihood and its impact together.

    Show answer

    Answer: True

    True. Relating risk to impact and likelihood is a statement about how large a risk is, separate from how a risk arises. Likelihood is how probable the harm is and impact is how bad it would be. A risk that is unlikely and minor is low; a risk that is likely and serious is high. Neither value alone is enough to judge the level.

    Revision sources: Session 8: Threat Actors, Attack Surfaces and Social Engineering (Classroom session record) · Threat Actor Types, Attributes and Motivations (Supplementary Study Guide explanation)

  4. A fictional company adds multi-factor authentication to a VPN that previously accepted a password alone. What has changed?

    Show answer

    Answer: The vulnerability is reduced, so harm is less likely; the threat still exists

    Fixing a vulnerability lowers the likelihood of harm without removing the threat. With multi-factor authentication a stolen password alone is no longer enough, so the weakness is reduced and a successful sign-in is less likely. Attackers with stolen passwords still exist, so the threat remains. The internal systems are as valuable as before, so the impact of a successful attack is unchanged.

    Revision sources: Threat Actor Types, Attributes and Motivations (Supplementary Study Guide explanation)

Study and revision

Practise through the Threat Actors & Attack Vectors topic. Questions cover the four questions, classifying Shadow IT, typical drivers, source and intent, threat knowledge, contractors, and the difference between a vulnerability, a threat and a risk; five flashcards recall the four questions, Shadow IT, the two scales of intent, the three terms and how a risk’s level is judged. Items that use this lesson’s supplementary explanation say so. Most are learning-only. The questions that have been verified against CompTIA Security+ SY0-701 objective 2.1 are also in the Security+ practice track; that does not mean the lesson covers the whole of an objective, and the lesson does not establish practical experience.

Consolidate

What to remember

  • Who, why, how and where: threat actor, motivation, attack vector and attack surface. Defenders mostly change where and how.
  • A vulnerability is a weakness, a threat is a danger that could exploit it, and a risk is the harm that could follow; its level comes from likelihood and impact.
  • Actor types suggest typical drivers and capability, but a type is a starting point, not proof.
  • How a victim was chosen and whether harm was meant are separate scales.
  • Insider describes trusted access, not intent; Shadow IT is a risk created by insiders, usually without malice.

Key terms

Threat actor

A person or group that may cause harm to systems or information. Threat actors are often assessed by their motivation, capability and opportunity.

Glossary entry

Threat

A potential cause of harm, such as an attacker seeking unauthorised access.

Glossary entry

Vulnerability

A weakness that a threat may exploit.

Glossary entry

Risk

Uncertainty and potential harm to an organisation’s objectives, considering what could happen, how likely it is, the consequences and the organisation’s context.

Glossary entry

Insider threat

The possibility of harm from someone with legitimate, trusted access to an organisation’s systems or information, whether they act deliberately or by mistake.

Glossary entry

Shadow IT

Technology, applications or services used for work without the organisation’s approval or management.

Glossary entry

Common misunderstandings

A vulnerability is a weakness; a threat is a potential danger that could exploit it. An unlocked door is a vulnerability. A burglar is a threat.

Shadow IT is unapproved technology, usually adopted by staff who are trying to work. It creates risk without anyone intending harm.

Opportunistic describes how the victim was selected. The attacker can fully intend harm without having chosen a particular victim.

Most insider incidents are mistakes. Insider describes trusted access; intent is a separate question, and contractors can be insiders too.

Nation-state is who is acting. Espionage, disruption and strategic advantage are why.

Further reading

Lesson sources and acknowledgements

Sources and scope

  • Covered in Session 8 (see the Session 8 Learning Log): the threat actor categories nation-state, organised crime, hacktivist, insider, unskilled attacker and competitor, with Shadow IT listed alongside them; the attributes of source, sophistication and capability, resources and funding, threat knowledge and adversary behaviour; intent, objectives and motivations; the shoplifter and heist-crew analogies; organised crime and competitors; insider threats, including a scenario about an employee taking technical files to a competitor; vulnerability, threat and risk; and leadership and security culture.
  • Accuracy qualifications: Shadow IT is treated here as an organisational risk and not as a threat actor in the strict sense, while noting that the Security+ objectives list it with threat actors; “threat knowledge” is used for the defenders’ understanding of threats; nation-state is an actor type and not a motivation; a whistleblower is not automatically a malicious actor; targeted or opportunistic and malicious or unintentional are separate scales; and the relationship between vulnerability, threat and risk is kept separate from the judgement of a risk’s level.
  • Supplementary explanation: the four questions and both diagrams, the definitions and the VPN example, the comparison table, the descriptions of each actor type, the Shadow IT example and its consequences, the attributes table, the driver, objective and intent chain, the insider examples, the contractor and working-from-home points, the wording of the leaver scenario, the professional statement of the leadership point, the Security+ terminology note, and the misunderstandings. These were developed afterwards and are my explanations, not the tutor’s words. The diagrams are original.
  • Guided version (published 1 November 2026, awaiting the site owner’s editorial review): the hospital opening questions, every question asked in the lesson with its feedback and hints, the back-door, phone-design, rota-tool, oil-company, caretaker and report-wording examples and the closing summary are supplementary explanation written for the Study Guide. The settings are fictional. The questions in the lesson’s steps are not revision-bank items; those in “Check your understanding” are, unchanged.
  • No practical work is claimed. Every organisation and incident in this lesson is fictional. I have not profiled a real threat actor or investigated an insider incident.

Taught in classroom sessions

Related lessons

Terms in this lesson

Practise this lesson

Quiz these topicsFlashcards