Threat Actors

Lesson plan

Level

Beginner

Time

About 65 minutes; the steps below add up to 65

Learners work out what a burglar needs, and which of the three a householder can change, before the terms motivation, capability and opportunity arrive. The rest of the lesson keeps returning to that one lever. Predictions precede the effect of MFA on two very different attackers, whether a label such as “hacktivist” reveals skill, whether a deceived receptionist is a threat actor, and what to do first when a file goes to the wrong person. The habit to build: describe what was observed, and change the opportunity, rather than guessing who the attacker is.

Objectives

• Describe any threat actor by motivation, capability and opportunity
• Explain which of the three a defender can change, and why that matters most
• Explain why a category of attacker is a starting point, not a conclusion
• Tell malicious, accidental, negligent and risky behaviour apart
• Turn the three ideas into questions a defender can ask about a system

Before the lesson

• Open this page on your own screen and use “Open the lesson window” to open the lesson in a second window. Share only that second window.
• Learners need the CIA Triad lesson first.
• Draw three columns on the board for the burglary answers; label them motivation, capability and opportunity only in the second step.
• The lesson takes about 65 minutes. To teach it in two parts, stop after “Categories are starting points”; the second part opens with “People and mistakes”.
• In presentation mode every step is shown in turns: Next reveals one moment, part or answer at a time, and the instructor view names what is on screen and what comes next.

Steps

1. Introduction Opening

   On screen: the lesson’s title, module and number; Next adds its objectives and key terms, as the lesson page lists them; Next again begins the first step.

   Objectives on screen

   • Describe any threat actor by motivation, capability and opportunity
   • Explain which of the three a defender can change, and why that matters most
   • Explain why a category of attacker is a starting point, not a conclusion
   • Tell malicious, accidental, negligent and risky behaviour apart
   • Turn the three ideas into questions a defender can ask about a system

   Purpose: Learners work out what a burglar needs, and which of the three a householder can change, before the terms motivation, capability and opportunity arrive. The rest of the lesson keeps returning to that one lever. Predictions precede the effect of MFA on two very different attackers, whether a label such as “hacktivist” reveals skill, whether a deceived receptionist is a threat actor, and what to do first when a file goes to the wrong person. The habit to build: describe what was observed, and change the opportunity, rather than guessing who the attacker is.

2. 1. What does a burglar need? Think 6 min

   Purpose: Find the three requirements of an attack from a familiar crime, and which one a defender controls.

   Ask

   • What did the burglar need? Three quite different things.
   • Which of the three can the householder change?

   Responses to expect

   • Answers like “a reason”, “a crowbar”, “an open window”. Sort them into the three unlabelled columns.
   • Some suggest an alarm changes the burglar's ability; ask whether it changes what they know, or the way in.
   • On screen in turns: the opening question, its answer; then the question on what the householder can change, and its answer.

   Discussion pause: Collect answers before revealing the explanation.

   In the lesson window

   • Think it through: What did the person who broke in need in order to do it? Try to name three quite different things.
   • Think it through: The householder wants to stop it happening again. Which of the three can they actually change?

3. 2. The idea Explain 5 min

   Purpose: Name threat actor, motivation, capability and opportunity, and state where the burglar comparison stops.

   Ask

   • Why is “nobody would bother attacking us” unsafe online?

   Responses to expect

   • Most see it once told that programs try thousands of organisations without choosing.
   • On screen in turns: the opening; then the three questions, starting with motivation; capability; opportunity; who controls each of the three; where the burglar comparison stops.

   If the explanation does not land: Use a bicycle left in town: the thief wants it (motivation), can cut a cheap lock (capability), and the bike is unlocked or poorly locked (opportunity). The owner controls only the lock.

4. 3. Motivation, capability and opportunity Explain 5 min

   Purpose: Restate the three ideas for computer systems and show the defender's uneven influence in the diagram.

   Ask

   • Which column of the diagram does the organisation have most control over?

   Responses to expect

   • Opportunity: the way in, which is the one column the organisation can work on.
   • Diagram: the defender’s levers are held back. Ask the class which of the three the school can influence most before revealing them.
   • On screen in turns: the opening; then the three ideas for computer systems; what it takes for a threat to become an attack, with the defender’s levers held back; where the defender has a lever, and the result.

5. 4. Compare two fictional attempts Experiment 12 min

   Purpose: Work through two attackers with the same motivation and very different capability, and the effect of removing the opportunity.

   Ask

   • Predict: MFA is added. What happens to A, and to B?
   • Which attacker would worry you more after MFA, and why?

   Responses to expect

   • Some think B is unaffected because B is skilled. Ask what B still lacks at the sign-in page.
   • On screen in turns: the opening; then Attacker A, step by step; Attacker B, step by step; one fact changed: the school adds MFA, and the prediction, and its answer; what happens to each attacker; the two attackers compared; what the comparison shows.

   Misconceptions to challenge

   • A learner may believe: “Capable attackers always use sophisticated techniques.” Respond: B used a password because a password was enough.

   To go further

   • What could the school do about B's next route, such as a phone call asking for the code?

   In the lesson window

   • Think it through: Predict what happens now to Attacker A and to Attacker B.

6. 5. Categories are starting points Predict 8 min

   Purpose: Introduce four categories and show that a category says more about motivation than about skill or identity.

   Ask

   • Does “hacktivist” tell you how skilled they are?
   • If an outsider uses Mr Bell's password, is Mr Bell an insider threat?

   Responses to expect

   • Some equate a dramatic result with expertise; ask how well the page was protected.
   • On screen in turns: the opening question, its answer; then four rough types of attacker, starting with organised crime; nation-state actors; hacktivists; malicious insiders; why a category is a first guess; the check question on Mr Bell’s stolen password, and its answer; where the types are compared in detail.

   Misconceptions to challenge

   • A learner may believe: “The category tells you how capable the attacker is.” Respond: Any category contains both skilled and unskilled attackers; a label is a guess about motives.

   Discussion pause: The categories reveal one at a time: before each row, ask what the class expects that type to want.

   In the lesson window

   • Think it through: A hacktivist group replaces a council’s home page with a political message. Does knowing it was hacktivists tell you how skilled they are?
   • Check your understanding: An outsider signs in to the school’s system with Mr Bell’s stolen password. Who is the threat actor?

7. 6. People and mistakes Predict 11 min

   Purpose: Separate malicious, accidental, negligent and risky behaviour, and put containment before blame.

   Ask

   • Is the deceived receptionist a threat actor?
   • The file went to the wrong parent: what happens first?

   Responses to expect

   • Some say yes because harm resulted. Ask what the receptionist intended.
   • “Find out who did it” is common; ask what is happening to the file meanwhile.
   • Another way to explain it: Compare a driver: hitting a parked car by misjudging a gap is accidental; driving after being told the brakes were faulty is negligent; deliberately ramming it is malicious.
   • On screen in turns: the opening question, its answer; then four words for what people do, starting with malicious; accidental; negligent; risky; how the four words overlap; the check question on the laptop in the car, and its answer; the misdirected attendance file, and what comes first, and its answer; the order of work, starting with reporting it; stopping it getting worse; establishing what happened; only then asking why; why protecting people does not wait for blame; how to record what an alert shows.

   Misconceptions to challenge

   • A learner may believe: “Any harmful action by staff is malicious.” Respond: Intent needs evidence, and blame can wait until the harm is contained.
   • A learner may believe: “The account in the log is the person who did it.” Respond: The account shows which access was used, not who used it.

   If the explanation does not land: Ask learners to sort four short stories into the four words of the table before reading it.

   In the lesson window

   • Think it through: A receptionist is taken in by a convincing fake sign-in page and types their password into it. Is the receptionist a threat actor?
   • Check your understanding: A teacher knows the rule against leaving laptops in cars, ignores it, and the laptop is stolen from the car. Which word fits best?
   • Think it through: What should happen first: finding out why it happened and who was at fault, or something else?

8. 7. A defensive question Experiment 7 min

   Purpose: Turn the three ideas into five questions and answer them for one system.

   Ask

   • Without knowing the attacker, what would you ask about the records system?

   Responses to expect

   • Pairs usually produce three or four of the five; the harm question is the most often missed.
   • On screen in turns: the opening question, its answer; then the five questions answered for the school, starting with who might want to misuse it; what each of them can do today; what opportunity exists; what harm could follow; which controls change the answers, and the result.

   Discussion pause: Reveal the five questions one at a time and let the class answer each for the school before the lesson’s answer appears.

   To go further

   • Answer the five questions for a system you use every day.

   In the lesson window

   • Think it through: You cannot know which attacker will turn up. What questions could you still ask about the school’s records system to decide what to fix?

9. 8. Apply it in a new situation Apply 4 min

   Purpose: Set up independent application, ideally on a later day.

   Ask

   • Who will try these now, and who later in the week?

   Responses to expect

   • The charity question tests automated, untargeted attempts; the download alert tests recording what was observed.
   • On screen in turns: the opening question, its answer; then the question on the overnight download, and its answer.

   In the lesson window

   • Apply it: A small charity says: “Nobody would bother attacking us. We have nothing worth stealing.” What is wrong with this?
   • Apply it: An alert shows that a nurse’s account downloaded 2,000 patient records at 03:00. What should the first written record say?

10. 9. Check your understanding Check 4 min

    Purpose: Check the lesson against the approved revision-bank questions.

    Ask

    • Answer individually, then compare before revealing.

    Responses to expect

    • The category-proof question is true or false; the answer is false.
    • On screen in turns: the opening; then the revision questions one at a time, each followed by its answer; where to practise next.

11. 10. What to remember Consolidate 3 min

    Purpose: Summarise the five points, the key terms and the misunderstandings.

    Ask

    • Without looking: which of the three does a defender mainly control, and why?

    Responses to expect

    • Opportunity; motivation and capability belong to the attacker.
    • On screen in turns: the opening; then the summary; the key terms; the common misunderstandings.

12. Lesson recap Closing

    On screen: the lesson’s objectives again; Next adds the closing question, which asks the class to explain each one in their own words without looking back. It says nothing about what anyone has learnt: use the answers to decide what to revisit.

    Points to listen for

    • Want, ability and a way in: an attack along a route needs all three.
    • Defenders mostly control the way in.
    • Labels hint at motives; attribution needs evidence.
    • A mistake is a risk to manage, not an attack to punish.
    • Contain first; write down what an account did, not whose fault it was.

Consolidation

• Want, ability and a way in: an attack along a route needs all three.
• Defenders mostly control the way in.
• Labels hint at motives; attribution needs evidence.
• A mistake is a risk to manage, not an attack to punish.
• Contain first; write down what an account did, not whose fault it was.