Threat Actor Types, Attributes and Motivations

Lesson plan

Level

Beginner

Time

About 90 minutes; the steps below add up to 92

Learners take a one-sentence news report apart into who, why, how and where, and see that the hospital can change only the last two, before the four terms (threat actor, motivation, attack vector, attack surface) are named. The rest of the lesson keeps separating ideas that sound alike: weakness, danger and harm; actor types and what drives them; Shadow IT as a risk rather than an actor; defenders' knowledge against attackers' behaviour; how a victim was chosen against whether harm was meant; and insider as access rather than intent. Each separation opens with a prediction in a setting other than the revision bank's. The habit to build: before using a term, ask which question it answers.

Objectives

• Take an attack apart into who, why, how and where, and name each with the right term
• Tell a vulnerability, a threat and a risk apart
• Compare the main types of threat actor by what drives them and what they can do
• Separate how a victim was chosen from whether harm was meant
• Explain why insider describes access, not intent, and why Shadow IT is a risk rather than an actor

Before the lesson

• Open this page on your own screen and use “Open the lesson window” to open the lesson in a second window. Share only that second window.
• Learners need the Threat Actors lesson first.
• Write the news report on the board, with space under four headings: who, why, how and where.
• The lesson takes about 92 minutes. To teach it in two parts, stop after “Attributes used to compare actors”; the second part opens with “Intent, objectives and drivers”.
• In presentation mode every step is shown in turns: Next reveals one moment, part or answer at a time, and the instructor view names what is on screen and what comes next.

Steps

1. Introduction Opening

   On screen: the lesson’s title, module and number; Next adds its objectives and key terms, as the lesson page lists them; Next again begins the first step.

   Objectives on screen

   • Take an attack apart into who, why, how and where, and name each with the right term
   • Tell a vulnerability, a threat and a risk apart
   • Compare the main types of threat actor by what drives them and what they can do
   • Separate how a victim was chosen from whether harm was meant
   • Explain why insider describes access, not intent, and why Shadow IT is a risk rather than an actor

   Purpose: Learners take a one-sentence news report apart into who, why, how and where, and see that the hospital can change only the last two, before the four terms (threat actor, motivation, attack vector, attack surface) are named. The rest of the lesson keeps separating ideas that sound alike: weakness, danger and harm; actor types and what drives them; Shadow IT as a risk rather than an actor; defenders' knowledge against attackers' behaviour; how a victim was chosen against whether harm was meant; and insider as access rather than intent. Each separation opens with a prediction in a setting other than the revision bank's. The habit to build: before using a term, ask which question it answers.

2. 1. Taking a report apart Think 6 min

   Purpose: Discover the four questions by taking a familiar kind of report apart, and see which the defender controls.

   Ask

   • Which words in the report answer who, why, how and where?
   • Which of the four could the hospital change?

   Responses to expect

   • “How” and “where” are often merged; ask whether the password and the page are the same kind of thing.
   • Some suggest changing who by deterring gangs; ask how a hospital would do that.
   • On screen in turns: the opening question, its answer; then the question on what the hospital can change, and its answer.

   Discussion pause: Fill in the four headings from the class before revealing the explanation.

   In the lesson window

   • Think it through: Take the report apart. Which words answer who? Why? How? And where?
   • Think it through: Which of the four could the hospital most directly change?

3. 2. Four questions that keep the ideas apart Explain 8 min

   Purpose: Name the four terms and follow the chain from actor to impact in the diagram.

   Ask

   • Read the diagram aloud as one sentence. Which link would you break first?

   Responses to expect

   • The vulnerability: add a second factor to the portal.
   • Diagram: step through the chain from actor to impact one link at a time, asking which of the four questions each link answers.
   • On screen in turns: the opening; then who, why, how and where, starting with who; why: intent or motivation; how: the attack vector; where: the attack surface; why each question leads to a different defence; the chain from threat actor to impact, one link at a time; the diagram’s stages one at a time; the chain read as one sentence.

4. 3. Vulnerability, threat and risk Predict 10 min

   Purpose: Separate weakness, danger and harm, and separate how a risk arises from how big it is.

   Ask

   • Broken lock, burglars nearby: which is the risk?
   • Why is “vulnerability + threat = risk = impact × likelihood” a muddle?

   Responses to expect

   • The lock is often named as the risk; ask what could happen because of it.
   • On screen in turns: the opening question, its answer; then the three words, starting with vulnerability; threat; risk; how a risk arises, and how big it is; the VPN example, with the vulnerability only; the threat; the risk; the level of risk, and what MFA changes; vulnerability, threat and risk side by side; why the two statements are not one formula.

   Misconceptions to challenge

   • A learner may believe: “A vulnerability is a threat.” Respond: A weakness and a danger that could exploit it are different things.

   If the explanation does not land: Use a house: the broken lock is the vulnerability, the burglar is the threat, the stolen television is the risk realised; how likely and how costly decide how worried to be.

   In the lesson window

   • Think it through: An office’s back door has a broken lock, and burglars are known to be working in the area. Which of these is the risk?

5. 4. The main types of threat actor Predict 12 min

   Purpose: Compare six actor types by driver and capability, and tell organised crime from competitors.

   Ask

   • What does each of the five usually want?
   • Phone designs at a rival, nothing paid: which type is likelier?

   Responses to expect

   • Drivers are usually guessed well; capability is where learners overrate hacktivists and underrate criminals.
   • On screen in turns: the opening question, its answer; then six types compared, starting with nation-state; organised crime; hacktivist; insider; unskilled attacker; competitor; where nation-state actors are examined; unskilled attackers; organised crime and competitors; the check question on the stolen phone designs, and its answer; hacktivists.

   Discussion pause: The types reveal one at a time: before each row, ask the class what that type usually wants and how capable it is.

   If the explanation does not land: Ask learners to place each type on a line from “money first” to “cause first”.

   To go further

   • Why might a competitor hire criminals rather than act itself?

   In the lesson window

   • Think it through: Before the table: what do you think each of these usually wants? A government’s spy agency; a criminal gang; a protest group; an employee with a grudge; a rival company.
   • Check your understanding: Designs for a new phone are stolen and turn up at a rival manufacturer. Nobody was paid for them. Which actor type is the more likely?

6. 5. Shadow IT is a risk, not an actor Predict 6 min

   Purpose: Show that Shadow IT creates risk without anyone being an attacker, and what the lasting answer is.

   Ask

   • The rota tool: is the team a threat actor? Has it created risk?

   Responses to expect

   • Some call it an attack because a rule was broken; ask what anyone intended.
   • On screen in turns: the opening question, its answer; then what shadow IT is; the personal cloud-storage account; why shadow IT is not a who; the lasting answer to shadow IT.

   Misconceptions to challenge

   • A learner may believe: “Shadow IT is a kind of attacker.” Respond: It is a situation that raises risk, usually caused by people trying to work.

   In the lesson window

   • Think it through: A team starts planning its rota in a free online spreadsheet tool, without asking IT, because the official system is clumsy. Is the team a threat actor?

7. 6. Attributes used to compare actors Explain 6 min

   Purpose: Teach the three attributes of an actor, and separate threat knowledge from adversary behaviour.

   Ask

   • Which phrase describes defenders, and which attackers?

   Responses to expect

   • Learners often guess the wrong way round; that is why the lesson asks.
   • On screen in turns: the opening; then the attributes of an actor, starting with source; sophistication and capability; resources and funding; the question on threat knowledge and adversary behaviour, and its answer; the two phrases, the right way round; how threat knowledge is built.

   Misconceptions to challenge

   • A learner may believe: “Threat knowledge means what attackers know.” Respond: It is what defenders know about threats, built by studying adversary behaviour, which is what attackers do.

   In the lesson window

   • Think it through: Before reading on: “threat knowledge” and “adversary behaviour”. Which do you think describes the defenders, and which the attackers?

8. 7. Intent, objectives and drivers Predict 9 min

   Purpose: Separate driver, objective and intent, and keep targeting and malice on two scales.

   Ask

   • The defaced oil-company site: was the victim chosen, and was harm meant?

   Responses to expect

   • Most get targeted; some call it accidental because the aim was attention.
   • On screen in turns: the opening; then the three questions behind why, starting with the driver; the strategic objective; the intent; the chain from driver to behaviour; the question on the protest group and the oil company, and its answer; two scales of intent; two cautions about labels; a caution about people: the whistleblower.

   Misconceptions to challenge

   • A learner may believe: “Opportunistic attacks are not really malicious.” Respond: Opportunistic is about selection; harm can be fully intended.
   • A learner may believe: “Nation-state is a motivation.” Respond: It is who acts; espionage or advantage are why.

   In the lesson window

   • Think it through: A protest group defaces the website of one particular oil company it opposes. Was the victim chosen, and was harm meant?

9. 8. Insider threats Predict 10 min

   Purpose: Define insiders by access, separate malicious from unintentional harm, and work through the leaver example.

   Ask

   • Is insider harm more often deliberate or accidental?
   • In the leaver example, who is the threat actor and what is the competitor's part?

   Responses to expect

   • Many expect deliberate; the breach studies point the other way.
   • On screen in turns: the opening question, its answer; then malicious insiders; unintentional insiders; internal is not the same as malicious; contractors and working from home; the engineer who leaves for a rival.

   Misconceptions to challenge

   • A learner may believe: “An insider threat means a disloyal employee.” Respond: Insider is about trusted access, and most insider harm is accidental.

   In the lesson window

   • Think it through: When insiders cause security harm, is it more often deliberate or accidental?

10. 9. Leadership and security culture Predict 4 min

    Purpose: Connect insider risk to leadership and culture.

    Ask

    • Why would staff copy leaders who ignore the rules?

    Responses to expect

    • Most mention example-setting; push for funding and enforcement too.
    • On screen in turns: the opening question, its answer; then what follows from weak leadership; why an insider’s mistake is rarely only theirs.

    In the lesson window

    • Think it through: In an organisation whose leaders ignore the security rules themselves, why might everyone else take the rules less seriously?

11. 10. Security+ terminology Explain 4 min

    Purpose: Map the lesson's terms to the Security+ objectives' wording.

    Ask

    • Which actor type is in the lesson but missing from the objectives' list?

    Responses to expect

    • Competitor: a recognised type, but absent from the current objectives.
    • On screen in turns: the opening; then the Security+ wording, starting with the threat actors listed; competitor; the attributes listed; the motivations listed.

    If the explanation does not land: Treat the list as vocabulary to recognise in exam questions: the reasoning in the lesson (for example, Shadow IT is a risk, not an attacker) still holds.

12. 11. Apply it in a new situation Apply 4 min

    Purpose: Set up independent application, ideally on a later day.

    Ask

    • Who will try these now, and who later in the week?

    Responses to expect

    • The caretaker tests source against intent; the report wording tests actor against motive.
    • On screen in turns: the opening question, its answer; then the question on the report’s wording, and its answer.

    In the lesson window

    • Apply it: A school caretaker, who has keys and a staff account, deletes a shared folder by mistake while tidying up files. How would you describe the source and the intent?
    • Apply it: A report says: “The attack was motivated by a nation-state.” What is wrong with the wording?

13. 12. Check your understanding Check 10 min

    Purpose: Check the lesson against the approved revision-bank questions.

    Ask

    • Answer individually, then compare before revealing.

    Responses to expect

    • The attributes question is multiple-select.
    • On screen in turns: the opening; then the revision questions one at a time, each followed by its answer; the revision questions on vulnerability, threat and risk, starting with the first; the second revision question; the third revision question; the fourth revision question; where to practise next.

14. 13. What to remember Consolidate 3 min

    Purpose: Summarise the five points, the key terms and the misunderstandings.

    Ask

    • Without looking: give the term for who, why, how and where.

    Responses to expect

    • Threat actor, motivation, attack vector, attack surface.
    • On screen in turns: the opening; then the summary; the key terms; the common misunderstandings.

15. Lesson recap Closing

    On screen: the lesson’s objectives again; Next adds the closing question, which asks the class to explain each one in their own words without looking back. It says nothing about what anyone has learnt: use the answers to decide what to revisit.

    Points to listen for

    • Four questions, four terms; defenders work mainly on the how and the where.
    • Weakness, danger, harm: three words for three different things.
    • An actor type is a first guess about drivers and capability.
    • Chosen or not, and meant or not: keep the two scales apart.
    • Insider is about access; Shadow IT is a risk, not an attacker.

Consolidation

• Four questions, four terms; defenders work mainly on the how and the where.
• Weakness, danger, harm: three words for three different things.
• An actor type is a first guess about drivers and capability.
• Chosen or not, and meant or not: keep the two scales apart.
• Insider is about access; Shadow IT is a risk, not an attacker.