In this chapter, we're going to discuss the fundamentals of threat intelligence.
As a Cisa analyst, you're expected to understand the trends and the scope of different threat actors
and how they proceed through the act of acting maliciously, whether it's Apts, nation states, or
script kiddies, you need to understand how those different threat actors correspond to the different
threats associated to your specific network.
You need to understand the intelligence that governs how they intercept different traffic patterns,
what threat actions they utilize, what different technologies they utilize, and how their overall
goals encompass what they're trying to achieve within each individual network.
CSA really appreciates and goes into depth with the idea that you need to understand at what level and
what corresponding threat action each threat actor used in to accomplish their specific goal, whether
it's for funds or financial information, maybe long term intelligence gathering information, or just
wreaking havoc across your network.
Nation state threat actors are sophisticated and well-funded and act on behalf of a government or an
agency that, in turn, acts for the government itself.
In the United States, that's usually the CIA or the NSA, but it can be DoD as well.
Nation state actors have a specific goal or agenda that they're trying to accomplish.
Now, that could be something like on the Russian Ukraine war, where they specifically were acting
as a precursor to actions against Ukraine.
It could also be on a more level base where the nation state actor is acting on behalf of, say, Iran,
where they took over websites and are specifically targeting those websites to provide, uh, propaganda
to prop up their own side of the story, regardless of where they're coming from.
And a nation state actor, you have to remember that those specific nation state actors have a specific
goal in mind.
And they're very sophisticated and well funded.
They have no problem for a long executed plan of action.
They may invade a enterprise network and then hang tight for six months to even two years before they
actually act.
They're there for the long term, and their plans are well executed and well funded, so they have plenty
of time to adopt and utilize that internal network to their advantage.
They're really not in it for the short term, knee jerk goal that you might see with other actors and
the threat actor atmosphere.
Advanced persistent threats are most notably utilized in correspondence with nation states, but not
always the big difference between a nation state and an advanced persistent threat.
And why most people get those two confused is that an advanced persistent threat does not have to be
funded by the government.
It could be a collaboration of different governments, or it could be a part of, say, the Taliban,
where we don't recognize the Taliban as an actual government.
They still are a terrorist organization that has an advanced persistent threat arm.
There are high level security and stealthy.
They are well coordinated and they're in it again for the long term.
There's a lot of overarching goals and overarching complexities when it comes to nation state versus
advanced persistent threat.
And the goals are usually similar in make and in what they're trying to achieve.
But again, the big difference between a nation state actor versus an advanced persistent threat is
an advanced persistent threat doesn't have to have the nation state backing in order to move forward
with its plans and goals.
Russia is usually an advanced, persistent threat that is not backed by the government.
They use highly intelligent and highly sophisticated attacks, but they use it to correspondingly within
different groups.
Their overarching goal may be for long term or maintaining access, and they're fairly coordinated,
but they're not really funded by the government in most, uh, and most of their actions, this would
align more to an advanced persistent threat as opposed to a nation state.
That doesn't mean the nation state can't come in and say, hey, you're doing these types of things,
and if you don't do what we want you to do, we're going to throw you in jail.
That would then become a nation state actor that's utilizing advanced persistent threat.
The waters get really muddy between an apt versus a nation state.
But just remember that an APT doesn't have to be funded by a nation state.
A nation state is funded by the state itself or the government.
Those are really the big differences between the two.
Organized crime is usually in it for the financial gain or for the money.
They're often organized and they're utilizing technology to extract or exploit financial gain out of
the opportunity that uses malware as their main form of injection, meaning that their overall goal
is financial gain.
And that's usually a short term technology that they're exploiting.
So when with the Colonial Pipeline incident, we saw that they had locked everything down with ransomware,
and then they required cryptocurrency in order for them to unlock something that's organized crime.
Remember, when it comes to organized crime, as far as threat actors are concerned, it's all about
the money Insider threats are intentional, usually disgruntled employees that are trying to do something
against the network because they're holding a grudge.
This is most related to somebody that maybe missed a promotion.
Maybe they feel the company is keeping them down.
It could be a different and variety of different reasons, but most often it's I've got a disgruntled
employee that was recently fired, or maybe they were written up for something and they're intentionally
doing something to the network out of spite.
Now, it's not always intentional.
Sometimes there's an unintentional consequence to that insider threat, and that can be clicking on
a piece of phishing email, accidentally downloading a piece of malware.
It could be either unintentional or intentional, and both are considered insider threats.
Incisa.
You need to understand that if isn't an employee and it's inside the internal network, it's considered
an insider threat regardless if it's intentional or unintentional.
Cisa doesn't care.
Script kiddies are usually your young people that are looking for a kick out of it.
They really lack the technical expertise Maybe they're getting into technology or cybersecurity for
the first time.
We often see this with college age students or even high school students, where they're really in it
to show off to their friends or get a kick out of the experience.
They have very low technical experience, low technical knowledge, but they usually find a tool online,
or they watch a video to show them how to hack into something.
And instead of keeping it in a virtual sandbox environment, they decide to do it against a website
or against a company.
Usually they're doing this for fun.
Script kiddies are in most cases, and I say most cases, young adults who are just trying to get a
kick out of doing something for fun.
They have very low technical expertise, and they're doing it with a makeshift tool that is already
out there.
Think your Maltego or your Metasploit technologies well.
Adapted vulnerabilities that have already been discovered.
And there's well, documentation out there, as well as tools that they could utilize by mostly just
pushing a button.
These are your script, kiddies.
Hacktivists could be either low technical or high technical.
It doesn't really matter but their overall goal is to wreak havoc on a network or on an industry, basically
for political needs.
They're really kind of trying to change the social perception of that organization.
So in our most recent activity here in the United States, we saw a lot of different political gains
that most people are trying to move for the political system, either one way or another.
If a hacktivist were to come in and exploit a website and post a lot of propaganda for a candidate or
against a candidate, that would be considered a hacktivist.
But it doesn't just have to be for political candidates.
It can be, you know, save the animals or save the whales, or I don't like this subway terminal because
they let people off.
When you think hacktivists think inside the United States or inside the country of origin, trying to
maneuver political perceptions and against or for a specific arc, their aim is usually well stated,
and they very clearly identify what they're trying to accomplish.
After all, it does no good to do a hack on a system and have it revealed to everybody.
If you can't tell them why you did it.
And this is really the hallmark of what a hacktivist is all about when it comes to threat actors.
As far as Cisa is concerned, you need to get past just understanding what a hacktivist is using for
or what a threat actor is trying to accomplish.
You need to understand the specific principles that make up that threat actor and what their overarching
goals look at different keywords.
Are they going for a political activity?
Are they doing it for fun?
Are they trying to get financial gain out of it?
Maybe it's a long term experiment that they're trying to pull off to get further information or industrial
information further down the road, meaning it's a long term plan of action.
All of these are keywords that you need to be aware of for your Cisa exam.
Expect to see scenario based questions that clearly identify what the goal or how they're going to achieve
that goal is.
Written out those will leads you clearly to the threat actor that you're trying to identify and expect
to see.
Questions associated with that.