Decoding A Threat Actor
In today’s era of Cyber Security, threat actors basically are the main actors or the malicious actors, whose behaviour is most crucial for an organisation. These intentionally cause harm to the organisation or business. They usually find vulnerabilities and flaws in the computer, networks, sensors or endpoints in your organisation and would do anything possible to breach the perimeter. Apart from big organisation, individuals can also be the prime targets for the threat actors.
The term “Threat Actor”, contains a broader view which could even include hactivists or terrorists and even trolls on internet are also considered to be as threat actors.
Most of the threat actor don’t discriminate by choosing their targets, they focus more on the vulnerabilities rather than individual people. In fact, they prefer mass attacks and automated attacks to infect and gain control over as many systems as they can and spread like a worm over the network.
In this blog we would look more deeper in different types of threat actors and their motivations, tactics, and techniques and of course how to protect yourself from these malicious threat actors.
Why to Worry About Threat Actor:
Threat Actor doesn’t attack on the individuals rather they target the vulnerabilities in a system.
Study conducted by University of Maryland, estimated that a cyberattack occurs in every 39 seconds, be it business or individual.
Although, your antivirus and XDRs are upto date, but the threat actor would usually find another ways to penetrate and harm your system. They are creative, they don’t stick to normal approaches, they find new ways, they design and make their own payloads.
You can use SIEM, SOAR or use logging to monitor your system. But if you ask my opinion, all this would not stop a Threat Actor. You are just not logging everything, Do you Log your IOT Devices or your CCTV Cameras or your Television attached to Conference Room.
Types Of Threat Actors:
On a broad basis, there are two types of Threat Actors: Insider Threat and External Threat
Insider Threats:
They may be your co-employees or contractors or former employees who already have access in your system. They don’t need to do a lot of hard-work, as 60% of their work is already done, as they are already in your system. They might use up their privileges or increase their privileges to execute a specific malicious task.
For example, a normal employee of your organisation might increase his privileges to admin level account and would be able to download a worm, which would disrupt your whole network or he might be able to execute a reverse shell.
External Threats:
This includes mainly but not limited to Nation-State Actors, Criminal Organisation or Hactivists. They generally are outside your network and have nuclear, technology or financial intentions.
Get Manubhav Sharma’s stories in your inbox
Join Medium for free to get updates from this writer.
Some of these attacks are government sponsored or some of them are carried out by cyber criminals or group of hactivists who are related to some political or social agenda.
For example, the recent Uber Hack, a 17 year old boy got access to the entire network and secrets of the Uber Platform, be it google drive or private reports or their antivirus system.
Tactics and Techniques of Threat Actors:
- Phishing: This is a social engineering technique that involves tricking a victim into revealing sensitive information or installing malware. Threat actors often use email or social media to deliver phishing attacks.
- Malware: This is a type of software that is designed to cause harm to a computer system or network. Threat actors often use malware to steal sensitive information or take control of a victim’s system.
- Exploits: These are vulnerabilities in software that can be used by threat actors to gain unauthorised access to a system or network. Threat actors often use exploits to bypass security measures and gain access to sensitive information or systems.
- Denial of Service (DoS) Attacks: These are attacks that aim to disrupt the availability of a website or online service. Threat actors often use DoS attacks to bring down critical systems or as a form of political protest.
- Advanced Persistent Threats (APTs): These are sophisticated and long-term attacks that are designed to compromise a target’s systems and steal sensitive information. APTs often use a combination of tactics and techniques and are often carried out by nation-state actors.
How to Protect Ourselves from Threat Actors:
One of the easiest way to gain access is through Social Engineering itself.
Let’s again revisit the Uber Attack, there the attacker used Phishing and Vishing techniques to persuade the employee to give him access, by claiming himself as an admin.
In my understanding, education and training to employees on this sector should be the top priority so that we could minimise the human error.
Proper policies and procedures should be decided by the CISO and strategies should be opted from different framework to recognise and avoid any sort of threats.
Usage of Multi-Factor Authentication (Something You Have, Something You Are, Something You Show), should be opted and softwares should be updated whenever a zero-day exploit patch is released. Proper vulnerability and penetration testing should be done to identify any weakness which can be a potential risk.
Conclusion:
Malicious threat actors could be making strategies right now, to target your system. By implementing multi-layered security approach and staying vigilant you can protect your system from these threat actors.
Remember to stay updated from any recent security attacks or trends and learn from it and apply the mitigation techniques in your system to prevent the same happening to your organisation.
Written By : Manubhav Sharma
Connect with me on : https://www.linkedin.com/in/manubhav-sharma/
