Topics in this domain
- Risk Management Concepts and Frameworks
- Inherent Risk, Residual Risk, Appetite and Tolerance
- Threat Actors, Motivations and Attack Vectors
- The Evolving Threat Landscape: AI, Cloud and Supply Chain
- Threat Modelling and Cyber Threat Intelligence
- Vulnerability Assessment and Scanning
- Control Deficiencies and Security Gap Analysis
- The Risk Assessment Process
- Qualitative Risk Analysis: Likelihood and Impact
- Quantitative Risk Analysis: SLE, ALE and Loss Estimation
- Risk Scenarios and Prioritisation
- Risk Treatment Options: Mitigate, Transfer, Avoid, Accept
- Risk Acceptance: Approval, Expiry and Review
- Cost-Benefit Analysis for Risk Treatment
- Risk Ownership vs Control Ownership
- RACI and Risk Escalation Paths
- The Risk Register
- Continuous Risk Monitoring and Key Risk Indicators
- Risk Reporting to Executives and the Board
- Integrating Risk Management into Business and IT Processes
Threat Actors, Motivations and Attack Vectors
Know your adversary
A small online shop and a defence contractor face very different attackers. Understanding who would target the organisation, what they want and what they can do makes likelihood estimates realistic, and stops the program spending heavily on threats that barely apply.
Who attacks, and why
| Actor | Motivation | Capability | Typical targets |
|---|---|---|---|
| Nation-states | Espionage, disruption, influence | Very high, patient, well resourced | Government, critical infrastructure, defence, intellectual property |
| Organised crime | Money | High; ransomware-as-a-service, fraud | Anyone who will pay |
| Hacktivists | A cause, publicity | Low to medium | Websites, embarrassing data |
| Malicious insiders | Money, grievance, coercion | Legitimate access | Data and systems they can already reach |
| Careless insiders | None; mistakes | n/a | Misdirected email, misconfiguration, lost devices |
| Competitors | Advantage | Medium | Trade secrets, pricing, bids |
| Opportunists | Curiosity, bragging | Low | Easy, unpatched targets |
Not every threat is a person. Errors, system failures and natural events (fire, flood, power loss) are threats too, and belong in the same risk process.
The usual ways in
- Phishing and social engineering: emails, calls and messages that trick people into clicking, paying or sharing.
- Stolen or weak credentials: password reuse, no MFA, credentials bought from earlier breaches.
- Unpatched vulnerabilities, especially in internet-facing systems such as VPN gateways and web applications.
- Misconfiguration: open cloud storage, default passwords, exposed admin interfaces.
- Third parties: suppliers, compromised software updates, managed service providers.
- Insiders misusing legitimate access, deliberately or by accident.
How an attack unfolds
Models such as the Lockheed Martin Cyber Kill Chain and MITRE ATT&CK describe attacks as a sequence of stages. Attackers need every stage to succeed; defenders get a chance to stop them at each one. ATT&CK also catalogues real techniques used at each stage, which helps check whether controls cover them.
Example. A ransomware group buys a stolen VPN password, logs in (there’s no MFA), escalates privileges, spreads to file servers over two weeks, then encrypts them. Detection at any of those stages could have stopped the final blow.
Building a threat profile
The security manager builds a profile specific to the organisation:
- Which actors are likely, given the industry, size and geography?
- What assets would they want?
- Which vectors do they favour?
- What does threat intelligence say about current campaigns against similar organisations?
- Which non-malicious threats (error, failure, disaster) matter most?
How the exam asks about it
| If the question asks… | The answer is usually… |
|---|---|
| Most common initial attack vector | Phishing and social engineering |
| Threat actor with legitimate access | Insider |
| Threat actor motivated mainly by money | Organised crime |
| Framework listing real attacker techniques | MITRE ATT&CK |
| Why profile threat actors? | Realistic likelihood estimates and targeted controls |
In short
- Threat actors differ in motivation, capability and persistence: nation-states, organised crime, hacktivists, insiders, competitors and opportunists.
- Insiders include malicious people with legitimate access and careless staff who make mistakes; both are significant sources of risk.
- The most common attack vectors are phishing and social engineering, stolen or weak credentials, unpatched vulnerabilities, misconfiguration and third parties.
- Attacks unfold in stages (reconnaissance, initial access, foothold, lateral movement, objective), giving defenders several chances to stop them.
- MITRE ATT&CK catalogues real attacker techniques and helps check whether controls cover them.
- Threats also include non-malicious events: errors, system failures, natural disasters.
Exam traps
- Not all threats are external or malicious; accidental insider errors cause many incidents.
- Likelihood depends on the actor's motivation and capability, not just on the existence of a vulnerability.
- A threat profile should be specific to the organisation and its industry, not a generic list.
- Prevention alone isn't enough; attacks have stages where detection can still stop them.
Slides
Click the slide and use the arrow keys. F toggles full screen.
Who attacks, and why
How an attack unfolds